fix(wire-shape): close 4 review gaps from #182 + #184 follow-up

CI-internal hardenings; no user-visible behaviour change.

- refresh.js: `--sha` with no value used to be silently consumed as
  the positional `specsDir`, masking the missing argument and routing
  the script through the gitHeadSHA fallback. Now exits 2 with a
  clear message.
- validate.js: an empty `registered_types` paired with non-empty
  cross_spec / intra_file / per_type_drift entries used to silently
  disable Gate 4 (rename-escape). The validator now treats this
  combination as a baseline corruption and fails the run. A genuinely
  fresh baseline (every section empty) still skips the gate as
  before, since the first-pin run has nothing to guard.
- lib.js writeBaseline: a crash between writeFileSync(tmp, ...) and
  renameSync(tmp, BASELINE_PATH) used to leave a `.tmp.<pid>`
  sidecar, which a future writer with the recycled PID would
  collide on. Now wraps in try/catch + unlinkSync on any throw.
- lib.js extractInterfaceProps: an `interface X extends Y` would
  silently under-report fields because we walk only iface.members.
  No such interface ships in the SDK today; the gate now warns
  loudly the first time one appears so coverage gets resolved
  before drift can hide. Full heritage walking is the proper fix
  if this becomes a routine pattern.

Verifications:

- refresh.js with `--sha` as last token exits 2; with `--sha foo` works.
- validate.js with corrupted baseline (empty registered_types but
  populated drift/cross_spec) exits 1 with explanatory message.
- writeBaseline temp-file is cleaned up on synthetic write error.
- Real baseline regenerates byte-identical to origin/main.

Author: saurabhjain1592

scripts/wire-shape/lib.js

@@ -220,6 +220,31 @@ function hasExportModifier(node) {
 }
 
 function extractInterfaceProps(iface) {
+  // A `heritageClauses` (e.g. `interface Foo extends Bar`) means the
+  // interface inherits members from its parents that we won't see by
+  // walking iface.members alone. The wire-shape gate would then
+  // under-report fields and silently miss drift on inherited
+  // properties. The TS SDK has no such interfaces today; flag it
+  // loudly the first time one appears so coverage gets resolved
+  // before it ships, instead of slipping past as invisible
+  // under-counting.
+  if (iface.heritageClauses && iface.heritageClauses.length > 0) {
+    const parents = [];
+    for (const clause of iface.heritageClauses) {
+      for (const t of clause.types || []) {
+        const expr = t.expression;
+        if (expr && ts.isIdentifier(expr)) {
+          parents.push(expr.text);
+        }
+      }
+    }
+    console.warn(
+      `wire-shape: interface ${iface.name.text} extends [${parents.join(', ')}]; ` +
+        'inherited fields are NOT walked. Add explicit field flattening to ' +
+        'scripts/wire-shape/lib.js::extractInterfaceProps before merging an ' +
+        'extending wire interface, or wire-shape coverage will be incomplete.',
+    );
+  }
   const names = [];
   for (const member of iface.members) {
     const name = propertyName(member);
@@ -290,8 +315,19 @@ function writeBaseline(baseline) {
     fs.mkdirSync(dir, { recursive: true });
   }
   const tmp = `${BASELINE_PATH}.tmp.${process.pid}`;
-  fs.writeFileSync(tmp, JSON.stringify(baseline, null, 2) + '\n');
-  fs.renameSync(tmp, BASELINE_PATH);
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(baseline, null, 2) + '\n');
+    fs.renameSync(tmp, BASELINE_PATH);
+  } catch (e) {
+    // Don't leave a `.tmp.<pid>` sidecar behind — the next run from
+    // the same PID would collide and confuse a future writer.
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+      /* tmp may not exist yet; ignore */
+    }
+    throw e;
+  }
 }
 
 function difference(a, b) {

scripts/wire-shape/refresh.js

@@ -44,7 +44,14 @@ function main() {
   let specsDir = null;
   let explicitSha = null;
   for (let i = 0; i < args.length; i += 1) {
-    if (args[i] === '--sha' && i + 1 < args.length) {
+    if (args[i] === '--sha') {
+      if (i + 1 >= args.length) {
+        // `--sha` as the last token used to be silently consumed as
+        // a positional `specsDir`, masking the missing value. Fail
+        // loudly instead.
+        console.error('error: --sha requires a value (e.g. --sha bf1ca22…)');
+        process.exit(2);
+      }
       explicitSha = args[i + 1];
       i += 1;
     } else if (!specsDir) {

scripts/wire-shape/validate.js

@@ -223,7 +223,29 @@ function main() {
   }
 
   // Gate 4: registered-type coverage.
-  if (baseline.registered_types.length > 0) {
+  // After the first introduction, the baseline always has registered
+  // types — emptying the list would silently disable the rename-
+  // escape guard. Fail loudly on an empty list unless the baseline
+  // is itself empty (genuine first-pin / fresh-repo case where every
+  // baseline section is empty).
+  const baselineIsFresh =
+    baseline.registered_types.length === 0 &&
+    Object.keys(baseline.per_type_drift).length === 0 &&
+    Object.keys(baseline.cross_spec_duplicates).length === 0 &&
+    Object.keys(baseline.intra_file_duplicates).length === 0;
+  if (baseline.registered_types.length === 0 && !baselineIsFresh) {
+    console.error(
+      'baseline.registered_types is empty but other baseline sections are not.',
+    );
+    console.error(
+      'This combination silently disables the rename-escape gate. Regenerate',
+    );
+    console.error(
+      'tests/fixtures/wire-shape-baseline.json via scripts/wire-shape/refresh.js,',
+    );
+    console.error('or remove the file entirely if introducing a fresh baseline.');
+    errors += 1;
+  } else if (baseline.registered_types.length > 0) {
     const missingSDK = [];
     const missingSpec = [];
     for (const name of baseline.registered_types) {