test(ownts): cover async ES5 function effect in leak controls (CodeRabbit)

The async-cleanup suppression path was only exercised via `async () =>` in
EffectLeakControl.tsx. Add a fifth control — `useEffect(async function () { …
return function () {} }, [])` — so the ES5 transpiled async shape is regressed
too: React still ignores the returned cleanup, so the listener must stay OWN001.
Bumps the expected count to 5 in the spike test and the CI step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PVeuchch67CtjSbizYm8gi

Author: claude

.github/workflows/ci.yml

@@ -1132,16 +1132,17 @@ jobs:
           # cleanup, observer.subscribe/unsubscribe — all released, zero findings.
           [ "$(echo "$rw" | grep -cE '\[(OWN|EFF|DI)[0-9]{3}\]')" -eq 0 ] \
             || { echo "FAIL: real-world cleanup patterns must not be reported"; exit 1; }
-      - name: False-negative controls (wrong controller / args / conditional / async) still leak
+      - name: False-negative controls (wrong controller / args / conditional / async arrow+ES5) still leak
         run: |
           python frontend/ownts/ownts.py frontend/ownts/examples/EffectLeakControl.tsx \
             -o "$RUNNER_TEMP/leak.facts.json"
           leak=$(python -m ownlang ownir "$RUNNER_TEMP/leak.facts.json" || true)
           echo "$leak"
           # a release-shaped cleanup that does not release THIS resource (wrong
-          # controller / mismatched args / conditional return / async effect) must
-          # not be over-suppressed — all four controls stay OWN001
-          [ "$(echo "$leak" | grep -c 'OWN001')" -eq 4 ] \
+          # controller / mismatched args / conditional return / async arrow effect /
+          # async ES5 `function` effect) must not be over-suppressed — all five
+          # controls stay OWN001
+          [ "$(echo "$leak" | grep -c 'OWN001')" -eq 5 ] \
             || { echo "FAIL: broadened matchers must not over-suppress real leaks"; exit 1; }
       - name: ES5 `function` callbacks parse; capture-mismatch leak caught (real bug shape)
         run: |

frontend/ownts/examples/EffectLeakControl.tsx

@@ -36,5 +36,15 @@ export function LeakControl({ enabled }: { enabled: boolean }) {
     return () => window.removeEventListener("message", onMessage);
   }, []);
 
+  // (5) async ES5 effect: same async suppression, but the transpiled
+  // `async function () { … }` shape — React still ignores the returned
+  // `function () {}` cleanup, so the listener leaks.
+  useEffect(async function () {
+    window.addEventListener("online", onOnline);
+    return function () {
+      window.removeEventListener("online", onOnline);
+    };
+  }, []);
+
   return <div>leak control</div>;
 }

frontend/ownts/test_ownts.py

@@ -65,10 +65,11 @@ def main() -> int:
 
     # False-negative controls: a release-shaped cleanup that does NOT release THIS
     # resource (wrong AbortController, mismatched unsubscribe args, a conditionally
-    # returned cleanup over an unconditional acquire) must STILL report the leak —
-    # the broadened matchers must not over-suppress.
+    # returned cleanup over an unconditional acquire, an async arrow effect, and an
+    # async ES5 `function` effect) must STILL report the leak — the broadened
+    # matchers and async suppression must not over-suppress.
     leaks = codes("EffectLeakControl.tsx")
-    assert leaks == ["OWN001"] * 4, f"EffectLeakControl -> {leaks}"
+    assert leaks == ["OWN001"] * 5, f"EffectLeakControl -> {leaks}"
 
     # Transpiled-ES5 shape: `function () { … return function () { … } }`. The parser
     # handles `function` callbacks + `return function` cleanups — a matched cleanup is