ci: run Paper color scanner tests

[Chris0Jeky]

Summary

• Register scripts/ci/check-paper-color-components.test.mjs in the reusable Paper Color Audit job used by required CI.
• Keep the existing audit command and job contract unchanged.

Verification

• node --test scripts/ci/check-paper-color-components.test.mjs -> 4 passed
• node scripts/ci/check-paper-color-components.mjs -> pass
• node scripts/check-docs-governance.mjs -> pass
• git diff --check -> pass
• Local actionlint unavailable; hosted workflow validation remains required.

Closes #2504

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Chris0Jeky]

Independent coordinator review at exact head bc0bb66: no CRITICAL/HIGH correctness, security, or data-loss findings. The change adds the existing scanner unit test as a separate step in the reusable job already invoked by required CI and preserves the existing audit step contract.

[Chris0Jeky]

Review (agent half of the ADR-0066 gate; Codex credits exhausted, SC-9): one fresh-context reviewer confirmed the test step precedes the scanner step, the workflow name/inputs/required-check name are unchanged, YAML matches siblings, and importing the scanner under node --test does not trigger a scan. Verdict SHIP. LOW (pre-existing): the job has no setup-node step and runs on the image's Node — consider a pinned setup-node step in a follow-up. CI-control region: parked for the maintainer's review per ADR-0066 / SC-10.

[Chris0Jeky]

Fresh-context re-review against the moved base (coordinator, 2026-09-06; SC-10 delegated, q-1 = A). VERDICT: SHIP. main had touched reusable-paper-color-audit.yml twice since the 2026-09-04 review (the #2502 SHA pins and the comment-ignoring scanner change f7aa1dd). Verified: the diff is three additive lines; the pinned actions/checkout is untouched and no uses: is added; the step sits after Checkout and before the audit step it guards; the registered test exists on current main (4 cases) and its expectations were hand-traced against the current scanner after f7aa1dd (all match); the audit job is unconditional in ci-required.yml. LOW: the workflow header's enumerated assertions do not mention the new step. Merged as 3674196d0.