Native dep audit: gated-family heuristic misses ungated node-gyp lifecycle addons

Known limitation surfaced while implementing the native dependency policy audit (#807).

Gap

The audit's "wants to build but unclassified" signal is a CPU/OS/libc-gated prebuilt family heuristic over pnpm-lock.yaml. It deliberately does not consume pnpm's build-script ledger (node_modules/.modules.yaml pendingBuilds), because:

• the pnpm-builder-contract CI job is install-free (no node_modules), and
• the pnpm-deps Nix FOD strips .modules.yaml from its normalized output for reproducibility (nix/workspace-tools/lib/mk-pnpm-deps.nix),

so no CI job ever sees pendingBuilds.

Consequence: a new ungated node-gyp lifecycle addon (e.g. bcrypt, better-sqlite3) added with no policy entry has a build script but no cpu/os/libc gating, so it is invisible to the gated-family check — exactly the case the original issue's rule (a) targeted.

Why accepted for now

A ledger-based check would require either bolting a real pnpm install onto the deliberately install-free contract job, or preserving .modules.yaml through the FOD (breaking the Nix determinism invariant the pnpm-deps closure depends on). Neither cost is justified today.

Possible future direction

If this gap matters, add a separate ledger-based check in a job that already has a populated node_modules (e.g. a post-install lane), consuming pendingBuilds to detect a build-wanting package absent from nativeDependencyPolicy. Until then this is documented in genie/external.ts and accepted.

Start with the native dependency audit in genie/external.ts and the pnpm lockfile heuristic described here. Read nix/workspace-tools/lib/mk-pnpm-deps.nix and inspect how pendingBuilds is unavailable; compare this with a post-install job that has node_modules. Done means the ungated node-gyp lifecycle-addon case is detected without weakening the install-free or reproducibility constraints.