chore(sync): re-sync fleet-canonical drift blocks

Picks up the `claude_md_fleet_drift`, `oxlint_fleet_ignore_drift`,
`oxfmt_fleet_ignore_drift`, and `gitattributes_fleet_drift` fixes that
the prior `chore(sync): cascade fleet template@72633be` run reported as
[FIXED] but didn't include in its auto-commit. Pure re-sync — no
behavior change.

Author: jdalton

.config/oxfmtrc.json

@@ -79,6 +79,7 @@
     "**/scripts/check-paths/types.mts",
     "**/scripts/check-paths/walk.mts",
     "**/scripts/check-prompt-less-setup.mts",
+    "**/scripts/check-soak-exclude-dates.mts",
     "**/scripts/fix.mts",
     "**/scripts/install-claude-plugins.mts",
     "**/scripts/install-git-hooks.mts",

.config/oxlintrc.json

@@ -1,7 +1,13 @@
 {
   "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
-  "plugins": ["typescript", "unicorn", "import"],
-  "jsPlugins": ["./oxlint-plugin/index.mts"],
+  "plugins": [
+    "typescript",
+    "unicorn",
+    "import"
+  ],
+  "jsPlugins": [
+    "./oxlint-plugin/index.mts"
+  ],
   "categories": {
     "correctness": "error",
     "suspicious": "error"
@@ -181,6 +187,7 @@
     "**/scripts/check-paths/types.mts",
     "**/scripts/check-paths/walk.mts",
     "**/scripts/check-prompt-less-setup.mts",
+    "**/scripts/check-soak-exclude-dates.mts",
     "**/scripts/fix.mts",
     "**/scripts/install-claude-plugins.mts",
     "**/scripts/install-git-hooks.mts",

.gitattributes

@@ -307,6 +307,11 @@
 .claude/hooks/setup-security-tools/test/setup-security-tools.test.mts linguist-generated=true
 .claude/hooks/setup-security-tools/test/shell-rc-bridge.test.mts linguist-generated=true
 .claude/hooks/setup-security-tools/tsconfig.json linguist-generated=true
+.claude/hooks/soak-exclude-date-annotation-guard/README.md linguist-generated=true
+.claude/hooks/soak-exclude-date-annotation-guard/index.mts linguist-generated=true
+.claude/hooks/soak-exclude-date-annotation-guard/package.json linguist-generated=true
+.claude/hooks/soak-exclude-date-annotation-guard/test/index.test.mts linguist-generated=true
+.claude/hooks/soak-exclude-date-annotation-guard/tsconfig.json linguist-generated=true
 .claude/hooks/stale-process-sweeper/README.md linguist-generated=true
 .claude/hooks/stale-process-sweeper/index.mts linguist-generated=true
 .claude/hooks/stale-process-sweeper/package.json linguist-generated=true
@@ -564,6 +569,7 @@ scripts/check-paths/state.mts linguist-generated=true
 scripts/check-paths/types.mts linguist-generated=true
 scripts/check-paths/walk.mts linguist-generated=true
 scripts/check-prompt-less-setup.mts linguist-generated=true
+scripts/check-soak-exclude-dates.mts linguist-generated=true
 scripts/fix.mts linguist-generated=true
 scripts/install-claude-plugins.mts linguist-generated=true
 scripts/install-git-hooks.mts linguist-generated=true

CLAUDE.md

@@ -62,7 +62,7 @@ Apply in: worktree creation, base-ref resolution for `git diff`/`git rev-list`,
 - **Package manager**: `pnpm`. Run scripts via `pnpm run foo --flag`, never `foo:bar`. After `package.json` edits, `pnpm install`.
 - 🚨 NEVER use `npx`, `pnpm dlx`, or `yarn dlx` — use `pnpm exec <package>` or `pnpm run <script>` # socket-hook: allow npx
 - 🚨 NEVER pass `--experimental-strip-types` to Node (enforced by `.claude/hooks/no-experimental-strip-types-guard/`).
-- **New dependencies** — every new dep added to `package.json` runs a Socket-score check at edit time; low-scoring deps block (enforced by `.claude/hooks/check-new-deps/`). The 7-day `minimumReleaseAge` soak is intentional malware protection; never add to `pnpm-workspace.yaml` `minimumReleaseAge.exclude[]` (bypass `Allow minimumReleaseAge bypass` for emergency CVE patches; enforced by `.claude/hooks/minimum-release-age-guard/`). Vitest `include` globs must not match `node:test` files — mismatched runners produce confusing "no test suite found" errors (enforced by `.claude/hooks/vitest-include-vs-node-test-guard/`).
+- **New dependencies** — every new dep added to `package.json` runs a Socket-score check at edit time; low-scoring deps block (enforced by `.claude/hooks/check-new-deps/`). The 7-day `minimumReleaseAge` soak is intentional malware protection; never add to `pnpm-workspace.yaml` `minimumReleaseAge.exclude[]` (bypass `Allow minimumReleaseAge bypass` for emergency CVE patches; enforced by `.claude/hooks/minimum-release-age-guard/`). Every per-package soak-bypass entry (the `'pkg@1.2.3'` exact-pin form) MUST carry a `# published: YYYY-MM-DD | removable: YYYY-MM-DD` annotation as the LAST comment line above the bullet — `published` is the version's npm publish date, `removable` is `published + 7d` so a periodic cleanup can drop entries that no longer need the bypass (enforced by `.claude/hooks/soak-exclude-date-annotation-guard/` at edit time + `scripts/check-soak-exclude-dates.mts` at commit time). Vitest `include` globs must not match `node:test` files — mismatched runners produce confusing "no test suite found" errors (enforced by `.claude/hooks/vitest-include-vs-node-test-guard/`).
 - **Bundler**: `rolldown`, NOT `esbuild`. The fleet standardizes on rolldown for direct bundling (see `template/.config/rolldown/`). Transitive esbuild deps (e.g. via vitest) are unavoidable today — the rule is no _new direct_ esbuild use anywhere in the fleet.
 - **Backward compatibility** — FORBIDDEN to maintain. Actively remove when encountered.
 - Full ruleset (packageManager field, `.config/` placement, `.mts` runners, soak time, shallow submodules, monorepo `engines.node`, `npm-run-all2` + `node --run` opt-in) in [`docs/claude.md/fleet/tooling.md`](docs/claude.md/fleet/tooling.md).