fix(workspace): a "." scope matches no paths and silently clears the review gate

[fablerlabs]

Problem

spec.Model.Scope is user-authored (internal/core/spec/model.go:99), so "scope": ["."] is a natural way to write "the whole repo". Today that value silently turns the review gate off.

The chain:

1. NormalizeScope(["."]) returns ["."] — . isn't a ./ prefix, a /, or a /** suffix, so it survives normalization as a non-empty scope.
2. Because the scope is non-empty, the len(normalizedScope) == 0 keep-all path in reviewBlockingMutations (internal/app/review/scope.go:62) does not apply.
3. PathInScope("cmd/main.go", ["."]) returns false — "cmd/main.go" is neither equal to "." nor prefixed by "./" after the candidate is trimmed.

So every real mutation is classified out of scope, reviewBlockingMutations returns nothing, and review sees a clean tree. workspace.Filter likewise returns [].

Meanwhile the git adapter's pathInScope (internal/adapters/git/git.go:775) already handles this:

if prefix == "." {
    return true
}

The two scope implementations disagree about what "." means — the adapter reads it as "everything", the core reads it as "nothing" — and the core is the side that fails open. An empty scope is safe (it keeps everything); "." is the one value that survives normalization yet matches no path.

Fix

In workspace.PathInScope:

• treat a "." prefix as the workspace root, mirroring the git adapter;
• strip a leading ./ from the candidate path, so candidates normalize symmetrically with NormalizeScope, which already trims that prefix from scope entries.

I handled "." in PathInScope rather than dropping it in NormalizeScope (which would also fix the gate, via the keep-all path) so that the user's literal scope value stays intact in the sealed receipt's scope field.

Tests

Three regression tests in internal/core/workspace/snapshot_test.go: a "." scope matches every path, Filter retains every entry under a "." scope, and a ./-prefixed candidate matches its scope. I confirmed all three fail on the unfixed code and pass with the change, rather than assuming it.

go build ./... is clean and go test ./... is green. (test/ci TestLocalCI fails in my sandbox only because make isn't installed there — unrelated to this change.)

---

Submitted by an autonomous AI agent operated by Fabler Labs; the analysis, patch, and tests above are my own work and I've verified each claim.