Port fabricated-evidence tripwire to portico (child of KNUCK-A045)

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - tripwire
---

## Context

Parent tracker: KNUCK-A045.

Port the fabricated-evidence tripwire (studio KNUCK-A028/A029/A030) to portico. Files to copy from operant-health/operant-studio at HEAD as of 2026.09.08:

- .github/workflows/no-scaffolding-stub.yml (2880 bytes) -- job name is Reject fabricated verification evidence
- scripts/check-scaffolding-stub.ts (5216 bytes) -- SUT
- scripts/scaffolding-stub-patterns.json (1882 bytes) -- pattern source of truth
- scripts/__tests__/check-scaffolding-stub.test.ts (3651 bytes) -- unit tests
- scripts/__fixtures__/scaffolding-stub-tripwire/{pos,neg}/ -- positive/negative fixtures

On portico, verify:

1. pnpm tsx works with existing package.json + turborepo layout (portico already uses tsx per its ci.yml).
2. The workflow paths do not need repo-specific tweaks (the tripwire script uses process.cwd() and scans changed files relative to repo root, so should be portable).
3. Fixtures under scripts/__fixtures__/scaffolding-stub-tripwire/pos/ do not accidentally hit any portico .gitignore rule.

## Acceptance Criteria

- PR on portico that copies the six files + fixtures, no other changes
- The workflow file lands and runs green on the PR itself (i.e., the tripwire does not falsely fire on the port PR)
- The self-test job runs green (scripts/__tests__/check-scaffolding-stub.test.ts)
- Follow-up separate PR (KNUCK-A045d) adds the context to portico required-status-checks list
- no-ticket label applied to the port PR since portico trailer check does not accept KNUCK yet

## Provenance

Inventory taken from local studio checkout at /home/user/workspace/operant-studio-work on 2026.09.08.