test: restore structural-guard tests rewritten against current paths

[toon-backlog-bot]

Summary

• Restores 4 test files removed in test: remove more stale structural tests (keep real ActivityTicker) #11 (org-wide CI fix), rewritten against the current repo structure instead of the stale paths that caused ENOENT failures.
• connector-version-alignment.test.ts: asserts DEFAULT_CONNECTOR_IMAGE is digest-pinned (ghcr.io/toon-protocol/connector@sha256:<64hex>) and DEFAULT_CONNECTOR_TAG is a valid semver. The workflow alignment check (CONNECTOR_VERSION_DEFAULT in publish-townhouse-images.yml) is guarded by it.skipIf — skips cleanly now, activates automatically when the workflow is added.
• docker/mill-dockerfile.test.ts: originally checked docker/Dockerfile.mill (removed during mill→swap rename). Now verifies the mill entry in the fixture image-manifest has the correct name/digest format and that both HS and direct compose templates define a digest-pinned mill service.
• docker/dvm-dockerfile.test.ts: same pattern for dvm.
• __tests__/dev-fixtures.test.ts: verifies all four fixture files exist, image-manifest.json has the expected five-entry structure with valid sha256 digests, and key cross-fixture invariants hold (connector tag in manifest matches dev compose; HS compose uses ≥5 digest-pinned images).

Verification

pnpm test -- src/connector-version-alignment.test.ts src/docker/mill-dockerfile.test.ts src/docker/dvm-dockerfile.test.ts src/__tests__/dev-fixtures.test.ts

Result: 20 passed | 1 skipped (workflow guard, activates when publish-townhouse-images.yml lands)

Full suite: 1505 passed | 3 skipped | 1 failed — the single failure is the pre-existing ActivityTicker.test.tsx USDC fallback failure noted in the #11 commit ("REAL failure — kept"), not introduced by this PR.

Deviation from Agent Assessment plan

Plan step 1 called for reading current docker/ Dockerfile names — there are no Dockerfiles in the current repo (hub uses pre-built registry images). The docker tests were rewritten to verify the equivalent structural invariants via the fixture image-manifest and compose templates instead.

Closes #10

[ALLiDoizCode]

Review: test: restore structural-guard tests rewritten against current paths

Checked:

Correctness — all assertions verified against current repo state

• DEFAULT_CONNECTOR_IMAGE = ghcr.io/toon-protocol/connector@sha256:48d2160e…de4 (64 lowercase hex chars) — matches the test regex ^ghcr\.io\/toon-protocol\/connector@sha256:[0-9a-f]{64}$ ✓
• DEFAULT_CONNECTOR_TAG = '3.10.4' — matches the semver regex ✓
• All four fixture files exist under src/__tests__/fixtures/compose-loader/ ✓
• Fixture image-manifest.json has exactly the five asserted keys (connector, dvm, mill, town, townhouse-api), all with valid 64-char hex digests ✓
• Cross-fixture invariant: fixture manifest connector tag 3.4.1 appears as connector:3.4.1 in townhouse-dev.yml ✓
• HS compose has five @sha256: digest pins (one per service) ✓
• it.skipIf(!existsSync(PUBLISH_WORKFLOW_PATH)) correctly skips the workflow-alignment check since publish-townhouse-images.yml doesn't exist yet ✓
• PUBLISH_WORKFLOW_PATH resolves to <repo-root>/.github/workflows/publish-townhouse-images.yml (3 levels up from src/) ✓
• File placement in src/docker/ is consistent with existing test files in that directory ✓

Minor non-blocking notes (not requesting changes)

1. Repetitive I/O: image-manifest.json is read and JSON.parsed four separate times in dev-fixtures.test.ts rather than once in a beforeAll. Negligible in practice but worth tightening on a future pass.
2. Weak count guard: HS compose uses digest-pinned images for all five services counts /@sha256:…/g matches ≥ 5 rather than asserting one per named service. A service added without a digest wouldn't be caught as long as another service compensated. Fine for now given the fixture is tightly controlled.
3. Fixture/constants tag drift: Fixture connector tag (3.4.1) is significantly behind DEFAULT_CONNECTOR_TAG (3.10.4). No cross-check links the two, so bumping DEFAULT_CONNECTOR_TAG leaves the fixture silently stale. The design appears intentional (fixture tests structural loading logic; connector-version-alignment tests production constants), but documenting this split would prevent future confusion.
4. Slightly misleading comment in mill-dockerfile.test.ts: States the Dockerfile was "removed during the mill→swap rename" but the current codebase still uses mill throughout (ACCOUNT_INDEX_MILL, MILL_HEALTH_PORT, etc.). The tests themselves are correct for the current naming.

No blocking issues. The guards correctly protect the image-manifest structure and connector version format, and the skipIf design elegantly future-proofs the workflow-alignment check.