fix: green socket-cli main 🔎 Check (script paths, citations, action port map, coverage badge) (#1437)

* fix: repoint moved fleet script paths and wire lockstep:emit-mirror-globs

The scripts/repo migration moved check.mts and update.mts into
scripts/fleet/, but packages/cli/package.json still pointed its
"check" and "update" scripts at the old ../../scripts/*.mts paths,
failing check-script-paths-resolve.

The lockstep-emit-mirror-globs.mts script cascaded in (and its sibling
lockstep:emit-schema is wired), but the root package.json never got the
matching lockstep:emit-mirror-globs alias, so the updating-lockstep skill
docs cited a pnpm script that did not resolve, failing
check-pnpm-run-citations-resolve.

- packages/cli/package.json: check -> ../../scripts/fleet/check.mts
- packages/cli/package.json: update -> ../../scripts/fleet/update.mts
- package.json: add lockstep:emit-mirror-globs pointing at the existing
  scripts/fleet/lockstep-emit-mirror-globs.mts shim

* fix: green remaining 🔎 Check residuals (action port map + coverage badge)

Two fleet-drift 🔎 Check failures on main, independent of the
script-path/citation fix:

- action-ports-are-lock-stepped: the setup-go-toolchain composite had
  no port-map entry. Its action.yml states it is "written inline so we
  don't depend on a third-party action" and only borrows actions/setup-go's
  generic fallback ordering, porting neither its input surface nor its
  go.dev/dl download algorithm — so it is Socket-original (`[]`), not a
  lock-stepped port.

- coverage-badge-is-current: the README carried a shields.io badge with a
  decimal percent (coverage-75.08%25) that the migrator's integer-only
  matcher could not recognize, tripping the unrecognized-form gate.
  Repointed to the canonical repo-local asset badges/coverage.svg (the
  generated placeholder SVG already exists and is tracked).

Author: jdalton

README.md

@@ -1,7 +1,7 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-![Coverage](https://img.shields.io/badge/coverage-75.08%25-brightgreen)
+![Coverage](assets/repo/badges/coverage.svg)
 
 [![Follow @SocketSecurity](https://img.shields.io/twitter/follow/SocketSecurity?style=social)](https://twitter.com/SocketSecurity)
 [![Follow @socket.dev on Bluesky](https://img.shields.io/badge/Follow-@socket.dev-1DA1F2?style=social&logo=bluesky)](https://bsky.app/profile/socket.dev)

package.json

@@ -42,6 +42,7 @@
     "// lockstep": "",
     "lockstep": "node scripts/fleet/lockstep.mts",
     "lockstep:emit-schema": "node scripts/fleet/lockstep-emit-schema.mts",
+    "lockstep:emit-mirror-globs": "node scripts/fleet/lockstep-emit-mirror-globs.mts",
     "// Setup": "",
     "setup": "node scripts/repo/setup.mts",
     "postinstall": "node scripts/repo/setup.mts --install --quiet",

packages/cli/package.json

@@ -35,7 +35,7 @@
     "build:sea": "node --max-old-space-size=8192 --import=./scripts/load.mts scripts/build-sea.mts",
     "build:js": "node scripts/build-js.mts",
     "dev:watch": "pnpm run build:watch",
-    "check": "node ../../scripts/check.mts",
+    "check": "node ../../scripts/fleet/check.mts",
     "check-ci": "pnpm run check",
     "lint": "oxlint -c ../../.config/oxlintrc.json",
     "lint-ci": "pnpm run lint",
@@ -71,7 +71,7 @@
     "test:validate": "node --import=./scripts/load.mts scripts/validate-tests.mts",
     "test-ci": "run-s test:prepare test:unit test:validate",
     "test-pre-commit": "cross-env PRE_COMMIT=1 pnpm test",
-    "update": "node ../../scripts/update.mts",
+    "update": "node ../../scripts/fleet/update.mts",
     "verify": "node scripts/verify-package.mts",
     "wasm": "node scripts/wasm.mts",
     "wasm:build": "node scripts/wasm.mts --build",

scripts/fleet/_shared/action-port-map.mts

@@ -78,6 +78,13 @@ export const COMPOSITE_ACTION_PORTS: Readonly<
   'setup-git-signing': [
     { portedAt: 'v7.0.0', upstream: 'crazy-max/ghaction-import-gpg' },
   ],
+  // Socket-original inline Go-toolchain locator: its header states it is
+  // "written inline so we don't depend on a third-party action". It only takes
+  // inspiration from actions/setup-go's generic fallback ordering (PATH →
+  // hosted toolcache → distro package manager → bail); it ports neither that
+  // action's input surface nor its go.dev/dl download algorithm, so there is no
+  // upstream release to lock-step against.
+  'setup-go-toolchain': [],
 }
 
 // Split an `<owner>/<repo>` slug; undefined when the shape is wrong. Pure.