Aperture infra_path_pattern drops files whose name merely contains gen/lib/out/test/… (no left boundary) #2415

Summary

Aperture._check_ignore_rules's Semantic Infrastructure & Test Target Shield
(gitgalaxy/core/aperture.py:513, regex defined at aperture.py:101) silently drops any
whitelisted source file whose filename merely contains the substring gen, lib, out,
test, spec, deps, build, dist, mock, docs, assets, scripts, vendor — because
the pattern has no left-hand word/segment boundary.

self.infra_path_pattern = re.compile(
    r"(?i)[-_./\\]?(?:gen|generated|build|dist|out|vendor|mock|test|spec|docs|assets|scripts|"
    r"__monolith__|__snapshots__|.github|.gitlab|node_modules|third[-_]?party|deps?|"
    r"lib(?:rary|raries)?)[-_./\\]?\b"
)

The leading [-_./\\]? is optional and there is no \b/(?:^|[-_./\\]) before the
alternation, so each alternative matches anywhere inside a path component. The trailing \b is
satisfied by the . before the extension.

Reproduction

Corpus: language-crucible v1.1.0, data/jcl/ (185 .jcl files). Scan with
galaxyscope <dir> --config .galaxyscope.yaml --db-only (no manifest → has_intent=False).

Two real, valid JCL files are dropped at the perimeter (ANOMALY: … | Blocked (System Exclusion, Hidden Directory, or Dynamic Ignored Dir)), never reaching prism/detector:

Minimal check:

import re
p = re.compile(r"(?i)[-_./\\]?(?:gen|...|lib(?:rary|raries)?)[-_./\\]?\b")
p.search("cobol-programming-course/DBRMLIB.jcl")   # -> matches "LIB."
p.search("cics-banking-sample-application-cbsa/MAPGEN.jcl")  # -> matches "GEN."

Blast radius

Not JCL-specific. Any repo scanned without an Intent Lock (has_intent=False — no recognized
manifest, or a file outside the manifest's declared scope) loses e.g. generator.py,
outbound.rs, libc_shim.c, specimen.rb, testbench.v, dependency_graph.go,
buildinfo.kt, … Real projects with manifests are partially shielded (the has_intent bypass),
which is why this has stayed latent.

Suggested fix

Require a real left boundary on the alternation so it only matches whole path segments /
separator-delimited tokens (the stated intent — "Matches boundaries commonly associated with
generated, build, vendor, and noise directories"):

r"(?i)(?:^|[-_./\\])(?:gen|generated|build|dist|out|vendor|mock|test|spec|docs|assets|scripts|"
r"__monolith__|__snapshots__|\.github|\.gitlab|node_modules|third[-_]?party|deps?|"
r"lib(?:rary|raries)?)(?:[-_./\\]|s?\b)"

(also note .github/.gitlab currently have an unescaped .). This is a change to
aperture.py file filtering → touches every language's scanned-file set → both golden masters
(tests/golden_master_audit.json, tests/golden_master_zero_dep_audit.json) will ripple and
must be re-blessed with a full Differential Scan + crucible_check.py.

Discovered by

tri-comparison-ledger-sweep skill, JCL manual-verification pass against the v1.1.0 corpus
expansion (jcl raw-corpus truth is 375 EXEC / 117 JOB; the engine scans 370 / 116 because of
this bug).