👷 ci: give the fetch-lib gate its own step and drop the delegation crutch

hack/test/ci_fetch_lib_hardening_test.sh reached CI only because the CI-HELMDL-01 gate
invoked it first. That is circular: delete the nested call and the fetch gate silently
stops running, which is exactly the state its own self-wiring assertion exists to
prevent. It also filed every fetch-lib failure under a step named "install-helm
hardening".

Wire it as its own lint step, immediately before the install-helm gate -- the helper is
the more fundamental diagnosis, so it should be the one read first -- and remove the
delegation from ci_install_helm_hardening_test.sh. The fetch gate's self-wiring
assertion accepts either route by design and needed no change; verified by replicating
its pipeline per candidate file, which now counts the ci.yaml step and zero delegation
hits. Its header comment claimed the delegation as current fact, so that is corrected.

The step's position is unchanged from where it already ran, so it still precedes the
Install Helm and yq steps; the gate needs neither.

Author: konih

.github/workflows/ci.yaml

@@ -238,6 +238,16 @@ jobs:
         run: bash hack/test/demo_01_default_samples_test.sh
       - name: Verify demo sample Kustomizations render (DOC-04)
         run: bash hack/test/demo_04_samples_kustomize_test.sh
+      # CI-FETCHLIB-01: the shared fetch helper (hack/lib/fetch.sh) that every hack/install-*.sh
+      # and the kind-e2e-setup action now download through. It gets its OWN step rather than being
+      # invoked from the CI-HELMDL-01 gate below, which is how it first reached CI: that route was
+      # circular (delete the nested call and this gate silently stops running) and it filed every
+      # fetch-lib failure under a step named "install-helm hardening". Not matched by the dist_* or
+      # sonar_ko_* globs, hence the explicit run. It goes BEFORE the install-helm gate because
+      # install-helm's hardening is now a property of the helper, so "the helper is broken" is the
+      # more fundamental diagnosis and the one an operator should read first.
+      - name: Verify shared fetch helper hardening (CI-FETCHLIB-01)
+        run: bash hack/test/ci_fetch_lib_hardening_test.sh
       # CI-HELMDL-01: hack/install-helm.sh is what the kind-e2e-setup composite action runs to
       # get helm, and a single transient `curl: (7)` to get.helm.sh reddened the REQUIRED
       # kind-smoke check on PR #351. This gate locks in the retry/protocol-pinning hardening

hack/test/ci_fetch_lib_hardening_test.sh

@@ -844,15 +844,16 @@ pass "the kind download goes through the shared helper, with no hand-rolled loop
 # Self-wiring. "An unwired gate is not a gate" (house precedent: hack/test/dev_mise_pin_drift_test.sh).
 # ================================================================================================
 #
-# This gate is reached in CI TODAY through hack/test/ci_install_helm_hardening_test.sh, which
-# .github/workflows/ci.yaml already runs as an explicit step in the lint job. That indirection
-# is deliberate and is recorded here rather than hidden: the lane that wrote this file does not
-# own .github/workflows/**, and shipping a gate that reds until an unrelated lane lands a
-# workflow line would be worse than shipping one that runs. The preferred wiring -- its own
-# named step, so a failure here is attributed to fetch-lib rather than to helm -- is a one-line
-# addition and is recorded in this lane's handover.
+# This gate is reached in CI through its own named step in the lint job of
+# .github/workflows/ci.yaml ("Verify shared fetch helper hardening (CI-FETCHLIB-01)"), so a
+# failure here is attributed to fetch-lib rather than to helm. It first reached CI by delegation
+# from hack/test/ci_install_helm_hardening_test.sh, because the lane that wrote this file did not
+# own .github/workflows/**; that crutch was circular -- deleting the nested call silently
+# unwired this gate -- and GATE-CIWIRING-02 replaced it with the workflow step and removed it.
 #
-# Either route satisfies the assertion; ZERO routes does not. The `-Fx` match on a trimmed,
+# The assertion below still accepts EITHER route, deliberately: it is a check that the gate is
+# reachable, not a check of which file reaches it, and pinning it to one spelling would red this
+# gate for a legitimate rewiring. ZERO routes is the failure. The `-Fx` match on a trimmed,
 # comment-stripped, `run:`-unwrapped view is what stops a commented-out or neutered invocation
 # ("# bash ...", "bash ... || true", "bash ... &") from counting as wiring: GATE-COMMENT-01 and
 # GATE-SCOPE-01, both from hack/test/dist_ci_wiring_test.sh, are the house records of a

hack/test/ci_install_helm_hardening_test.sh

@@ -61,25 +61,6 @@ pass() {
 [[ -f "${LIB}" ]] ||
   fail "${LIB} is missing -- hack/install-helm.sh sources it for every fetch, so the flag assertions below would have nothing to inspect"
 
-# ---------------------------------------------------------------------------------------------
-# CI-FETCHLIB-01 sibling gate, run FIRST.
-#
-# hack/test/ci_fetch_lib_hardening_test.sh proves the shared helper's behaviour against a real
-# local HTTPS origin, and asserts that every hack/install-*.sh routes through it. This file is
-# invoked from an explicit step in the lint job of .github/workflows/ci.yaml; the sibling is not,
-# because the lane that added it does not own .github/workflows/**, and the dist_*/sonar_ko_*
-# globs in that job do not match its filename. Invoking it here is what keeps it in CI rather
-# than in the tree-but-never-run state that makes a gate decorative.
-#
-# It runs BEFORE this file's own assertions on purpose: install-helm.sh's hardening is now a
-# property of the helper, so "the helper is broken" is the more fundamental diagnosis and is the
-# one an operator should read first. The lane handover records the one-line ci.yaml step that
-# would give the sibling its own name in the job log; until that lands, this is the wiring.
-# ---------------------------------------------------------------------------------------------
-echo "--- CI-FETCHLIB-01 shared fetch helper gate ---"
-bash "${ROOT}/hack/test/ci_fetch_lib_hardening_test.sh"
-echo "--- back to CI-HELMDL-01 install-helm assertions ---"
-
 # ---------------------------------------------------------------------------------------------
 # Static assertions over the source text.
 # ---------------------------------------------------------------------------------------------