Fix TestFormal_TestIDFormatWellFormed for shared CTR test ID allocation

[Copilot]

The pkg/workflow unit shard fails on TestFormal_TestIDFormatWellFormed:

expected: "T-CTR-025"
actual  : "T-CTR-039"

The test asserted testID == "T-" + ruleID for every compliance-map entry. That invariant broke when spec 1.0.23 added CTR-025 (Framework Self-Prompt Misattribution), which is intentionally mapped to T-CTR-039 — T-CTR-025 is already claimed by the §8.2 optimizer-protocol catalog (T-CTR-024…T-CTR-038). Test IDs come from one sequence shared across §8.1 and §8.2, so numeric alignment with rule IDs was never a real invariant. The spec and compliance map are correct; the assertion was not.

Changes

• pkg/workflow/compiler_threat_detection_compliance_formal_test.go — replaced the numeric-identity assertion with format checks plus test ID uniqueness:

  mapping := formalComplianceMap(t)
  for ruleID, testID := range mapping {
      require.Regexp(t, formalRuleIDPattern, ruleID)
      require.Regexp(t, formalTestIDPattern, testID)
  }
  require.True(t, formalHasUniqueTestIDs(mapping))

  Rule↔test correspondence stays enforced by TestFormal_RuleTestIDBijection (map must agree with the §8.1 catalog), TestFormal_NoOrphanTestID, and TestFormal_ActiveRuleCoverageComplete, so no coverage is lost.

• specs/compiler-threat-detection-spec.md §8.1 and specs/compiler-threat-detection-compliance/README.md — documented that test IDs are allocated from a sequence shared with the §8.2 catalog and need not match their rule ID number, citing CTR-025 → T-CTR-039, so the assumption isn't reintroduced with the next rule.

[Copilot]

Pull request overview

Fixes formal compliance validation for test IDs shared across core-rule and optimizer catalogs.

Changes:

• Replaces numeric ID alignment with format and uniqueness checks.
• Documents shared test-ID allocation and the CTR-025 exception.

Show a summary per file

File	Description
pkg/workflow/compiler_threat_detection_compliance_formal_test.go	Updates compliance-map validation.
specs/compiler-threat-detection-spec.md	Documents shared ID sequencing.
specs/compiler-threat-detection-compliance/README.md	Clarifies compliance-map ID allocation.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.1