chore(sync): cascade validators + token-guard + install-sfw

Wheelhouse cascade picks up several fixes:

- `scripts/validate-file-size.mts` — SKIP_DIRS includes `external/`
  so vendored bundles stop tripping the validator on every commit.
- `scripts/validate-esbuild-minify.mts` — newly cascaded (added to
  the sync manifest so future drift surfaces).
- `.claude/hooks/token-guard/index.mts` — sensitive-name fragment
  regex tightened to underscore-token boundaries (`$AUTHOR_NAME` no
  longer trips `AUTH`).
- `scripts/install-sfw.mts` — `prefer-exists-sync` disable rationale
  moved onto the directive (canonical convention).
- `.config/oxlintrc.json` + `.config/oxfmtrc.json` — fleet-canonical
  block refreshed with the two new validator paths.
- `.gitattributes` — linguist-generated block refreshed.

Author: jdalton

.claude/hooks/no-fleet-fork-guard/test/index.test.mts

@@ -74,6 +74,8 @@
     "**/scripts/socket-wheelhouse-schema.mts",
     "**/scripts/update.mts",
     "**/scripts/validate-config-paths.mts",
+    "**/scripts/validate-esbuild-minify.mts",
+    "**/scripts/validate-file-size.mts",
     "#fleet-canonical-end"
   ]
 }

.claude/hooks/token-guard/index.mts

@@ -119,6 +119,8 @@
     "**/scripts/socket-wheelhouse-schema.mts",
     "**/scripts/update.mts",
     "**/scripts/validate-config-paths.mts",
+    "**/scripts/validate-esbuild-minify.mts",
+    "**/scripts/validate-file-size.mts",
     "#fleet-canonical-end"
   ]
 }

.config/oxfmtrc.json

@@ -230,4 +230,6 @@ scripts/socket-wheelhouse-emit-schema.mts linguist-generated=true
 scripts/socket-wheelhouse-schema.mts linguist-generated=true
 scripts/update.mts linguist-generated=true
 scripts/validate-config-paths.mts linguist-generated=true
+scripts/validate-esbuild-minify.mts linguist-generated=true
+scripts/validate-file-size.mts linguist-generated=true
 # ─── END fleet-canonical ────────────────────────────────────────