test: guard against ejs regressing below ^6.0.1 (DII-2600)

[manisha1997]

DII-2600

Regression guard for the ejs@^6.0.1 override added in #315. Split out of that PR so the CVE
fix and the new CI check can be reviewed separately.

Base branch: this targets fix/ejs-critical-cve-override_internal, not main. The guard
asserts that overrides.ejs exists, and main does not have that block yet — based on main
this PR would fail its own CI. Merge #315 first, or merge this into it.

Why

ejs is not a direct dependency. It arrives through @oclif/core, whose 1.x and 2.x lines still
declare ejs: ^3.x. The 6.0.1 floor is held only by the overrides block in package.json,
which a dependency bump, a lockfile regeneration, or a merge can drop silently — quietly
reintroducing CVE-2023-29827.

Nothing upstream of the repo catches that: npm pack ejs@3.1.10 still succeeds through our
internal registry, so curation would not block a regression either. (That also answers the open
question in the Curation probe (ejs) step added in #315: ejs@6.0.1 is fetchable, and 3.1.10
still is too — so that informational probe can be retired in favour of this guard.)

What

.github/scripts/verify-ejs-override.js asserts the floor from three independent angles:

1. package.json — the overrides.ejs declaration exists and holds the floor
2. package-lock.json — every resolved ejs entry satisfies the floor
3. node_modules — every ejs copy actually installed satisfies the floor

Checks 1 and 2 need no install, so the guard runs before npm ci as a fail-fast step in the
lockfile-hygiene job. Check 3 catches a nested 3.x copy that a lockfile check alone would miss.
Zero dependencies, so it cannot itself be broken by a dependency change.

Wired into unit tests (pre- and post-install), the audit check, and the release workflow.

Test report

Verified it passes on a healthy tree and actually fails on four seeded regressions:

Scenario	Caught by	Exit
overrides.ejs deleted + lockfile back to 3.1.10	package.json + lockfile	1
Override intact, lockfile hand-edited to 3.1.10	lockfile	1
Override weakened to ^3.1.10	package.json + lockfile	1
Lockfile clean, stale @oclif/core/node_modules/ejs@3.1.10 on disk	on-disk walk	1
Healthy tree	—	0

Failure output names the advisory, gives remediation steps, and emits a GitHub Actions ::error
annotation.

Also confirmed on this branch: npm ls ejs → single deduped ejs@6.0.1, 205 tests passing,
lint clean, npm audit --audit-level=moderate --production → 0 vulnerabilities.

Checklist

• I acknowledge that all my contributions will be made under the project's license
• I have made a material change to the repo (functionality, testing, spelling, grammar)
• I have read the Contribution Guidelines and my PR follows them
• I have titled the PR appropriately
• I have updated my branch with the main branch

🤖 Generated with Claude Code