fix(ci): quote a workflow step name that YAML truncates at " #", add a guard

`.github/workflows/lint.yml` carried one `- name:` step name as an unquoted
plain scalar containing ` #13419` -- YAML reads a space + hash inside an
unquoted plain scalar as the start of a comment, so the step's real parsed
name was the three-letter string `The`, not the text an author wrote. Quote
the scalar so the full text stays part of the value.

Add `check:workflow-step-name-quoting` (scripts/check-workflow-step-name-quoting.mjs),
a grep-level guard wired as the last step of the `lint` job: an unquoted
`- name:` value containing ` #` is a violation, using the criterion triage
priced and the PM ruling confirmed (#15149) -- look only at the first
non-blank character after `- name:`, and never judge "quoted" by stripping
quote characters, which false-positives on a legal unquoted name carrying an
embedded `"` (check-links.yml's real specimen, pinned as the guard's negative
control).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

Author: claude

.github/workflows/lint.yml

@@ -743,7 +743,7 @@ jobs:
       # production zero could equally be a scanner that stopped matching.
       # Invoked as `node` rather than `pnpm check:*`: see the GATE INVOCATION
       # IDIOM note at the top of this file. ~1s, no spawns.
-      - name: The #13419 name-fold fixture has no non-test loader
+      - name: 'The #13419 name-fold fixture has no non-test loader'
         run: |
           node scripts/check-position-name-fold-loaders.mjs --self-test
           node scripts/check-position-name-fold-loaders.mjs
@@ -4396,6 +4396,21 @@ jobs:
       - name: Duration-shaped spec keys carry their unit in the key name
         run: pnpm --filter @objectstack/spec check:duration-unit-keys
 
+      # #15149. Grep-level guard for the defect this very repo just shipped: an
+      # unquoted `- name:` step name containing ` #` is silently truncated by
+      # YAML at that point (a space + hash starts a comment inside a plain
+      # scalar), so the step's real parsed name is not the text an author
+      # wrote -- the CI log names the step something else entirely, and
+      # anything that resolves a step by its name text (scripts/pm/ci-failure.mjs)
+      # cannot find it. This repo names issue numbers in step names as a
+      # matter of style, so the shape is likely to recur. Deliberately NOT a
+      # YAML-parser-level name comparison -- see the header of
+      # scripts/check-workflow-step-name-quoting.mjs for why grep-level is
+      # sufficient (triage ruling, #15149). Reads .github/workflows/*.yml as
+      # plain text; no build, sub-second.
+      - name: 'Unquoted workflow step names do not silently truncate at " #" (#15149)'
+        run: pnpm check:workflow-step-name-quoting
+
   # Lane 1 of 4 behind the required `TypeScript Type Check` context. The
   # aggregator job at the bottom of this file explains the split, holds the
   # contract, and is the thing the merge queue actually requires — read it

package.json

@@ -141,6 +141,7 @@
     "check:node-version": "node scripts/check-node-version.mjs",
     "check:pnpm-acquisition": "node scripts/check-pnpm-acquisition.mjs --self-test && node scripts/check-pnpm-acquisition.mjs",
     "check:workflow-status-functions": "node scripts/check-workflow-status-functions.mjs --self-test && node scripts/check-workflow-status-functions.mjs",
+    "check:workflow-step-name-quoting": "node scripts/check-workflow-step-name-quoting.mjs --self-test && node scripts/check-workflow-step-name-quoting.mjs",
     "check:select-shard-packages": "bash scripts/ci/select-shard-packages.selftest.sh",
     "check:select-gate-families": "bash scripts/ci/select-gate-families.selftest.sh",
     "check:shard-attestation": "node scripts/check-shard-attestation.mjs --self-test && node scripts/check-shard-attestation.mjs",