[yakimoto]

Moves the governance-enforce install of @wave-av/governance off GitHub Packages (retired; it answers 403, billing limit) and onto WAVE's self-hosted private registry, read with WAVE_REGISTRY_READ_TOKEN. Part of WAVE-33109 under WAVE-33105.

Read this first: the step still can't run here

This repository is public. ci-smoke's host allowlist gives a public repository no job-secrets row (host/buildkite/secrets-allowlist.tsv: "a public repository gets no row (cli was removed for that)"). So on Buildkite, governance-enforce stops at its first check, WAVE_REGISTRY_READ_TOKEN is not set, before any credential could be used. That is the same outcome as today, but now the message is accurate. #94 parks the step for the same reason. This PR doesn't change that policy. It removes the retired GitHub Packages path, so if the step is ever un-parked it installs from the right place with the right token.

Change (.buildkite/)

• lib/common.sh: captures WAVE_REGISTRY_READ_TOKEN and WAVE_REGISTRY_URL into non-exported shell variables and unsets both. It also unsets the retired NODE_AUTH_TOKEN, which nothing reads any more.
• lib/npm-install.sh:
  • A public repository never names the private registry host. The URL comes from the host job-secrets path as WAVE_REGISTRY_URL, next to the token.
  • It must be a bare https origin ending in / (^https://[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]{1,5})?/$). That rules out credentials, paths, queries, uppercase and newline injection.
  • The job-local npmrc is @wave-av:registry=<URL> plus //<host[:port]>/:_authToken=${WAVE_REGISTRY_READ_TOKEN}, mode 600, holding the placeholder and never the value.
  • The one npm install also gets NPM_CONFIG_GLOBALCONFIG=/dev/null and the registry CA as NODE_EXTRA_CA_CERTS.
  • bk_npm_drop_token deletes the npmrc as soon as the install returns, before the enforcer and the git fetches run.
• governance-enforce.sh: unchanged. It still pins @wave-av/governance@0.4.6 and installs with --ignore-scripts.
• README.md: the credential row, the Credentials section and the prerequisites line (the old one said npm.pkg.github.com).
• New .buildkite/tests/registry-install.test.sh (offline). An npm stub records names and facts, never the token value, and a node shim answers the step's Node 22 check. It is not wired into a step.

Proof

• Test: 32/32 pass on this branch and 11/32 on main b7c264d. The 21 failures are the bug: the GitHub Packages npmrc, no CA or null globalconfig, the token leaking into the enforcer's environment, the npmrc surviving until exit, and no URL validation.
• 11 mutations of the fix, each caught by the test:
  • no CA, or no null globalconfig
  • not unsetting the new names, or keeping the legacy one
  • a NODE_AUTH_TOKEN fallback
  • not deleting the npmrc
  • a loose URL pattern, or no URL check at all
  • the internal host named in a comment
  • no fork fence
  • the token value written into the npmrc
• shellcheck -x 0.11.0 is clean on every .buildkite script.
• The test also checks that nothing under .buildkite/ names a *.internal host. This PR body doesn't either.
• Overlap: ci(buildkite): render steps from the wave-ci custom template #94 edits lib/common.sh and README.md. A three-way merge with it is clean for both files, and the test still passes 32/32 on the merged common.sh. ci(buildkite): add a repo script for pipeline upload #93 touches only .buildkite/upload.sh.
• The pushed blobs and modes match the local files: the scripts keep 100755 and the test is 100644.
• Not run: a live install. That needs a job-secrets row, which the public-repo rule forbids.

Needs a decision (not done here)

To run this step for real, the owner would have to allow a public repository a job-secrets row for governance-enforce (WAVE_REGISTRY_READ_TOKEN, WAVE_REGISTRY_URL), and add WAVE_REGISTRY_URL to the host's secret store. Both widen access, so neither is proposed as a row here. The alternative #94 points to, an image-served enforcer or fleet-level coverage, needs no credential in this repository at all.

Draft. Do not merge without review.