fix(slice-09 packaging): freshness guard fails on assembled-but-incomplete vendored bundle

Guard verdict qitem-20260518055713 — release-gate blind spot: an
assembled bundle (vendored dist present) with a missing vendored
conveyor spec used to silently pass because both spec-touching tests
had a "skip when vendored spec absent" early-return. That's exactly
the artifact class the guard is meant to catch — scripts/build-package.sh
assembles BOTH dist + specs, so dist-present + specs-missing is
incomplete assembly that would break `rig up conveyor`.

Fix:
- Test 2 (conveyor spec slice-01 can_observe): skip only when no
  vendored bundle has been assembled (vendoredAssembled() === false).
  When assembled, REQUIRE the vendored conveyor spec to exist;
  missing fails with rebuild guidance, then reads + asserts
  can_observe.
- Test 3 (general byte-equal staleness): when source has the conveyor
  spec, require vendored to also have it before byte-comparing.
  Missing = fail, not skip.

Discriminator proven empirically:
- baseline (fresh assembled): 3/3 pass
- simulated assembled-bundle-missing-vendored-conveyor-spec (mv'd the
  vendored spec out): tests 2+3 FAIL with clear 'run
  scripts/build-package.sh' messages
- restored: 3/3 pass

Scope: single file, scripts/check-cli-daemon-freshness.test.mjs.
No daemon, no resolver, no semantic changes.

scripts/check-cli-daemon-freshness.test.mjs

@@ -68,13 +68,20 @@ test("baseline-fix-packaging guard: vendored daemon dist carries slice-09 rig-po
 });
 
 test("baseline-fix-packaging guard: vendored conveyor spec carries slice-01 can_observe edge when assembled (qitem-20260518054046)", () => {
-  if (!fs.existsSync(path.join(VEND_SPECS, "rigs/launch/conveyor/rig.yaml"))) {
+  // Skip ONLY when no vendored bundle has been assembled at all
+  // (fresh clone / clean state). Per guard verdict
+  // qitem-20260518055713: an assembled bundle (dist present) that is
+  // missing the conveyor spec is a stale/incomplete artifact and MUST
+  // fail this gate, not skip silently.
+  if (!vendoredAssembled()) {
     return;
   }
-  const vendoredSpec = fs.readFileSync(
-    path.join(VEND_SPECS, "rigs/launch/conveyor/rig.yaml"),
-    "utf-8",
+  const vendoredSpecPath = path.join(VEND_SPECS, "rigs/launch/conveyor/rig.yaml");
+  assert.ok(
+    fs.existsSync(vendoredSpecPath),
+    `Vendored daemon dist is assembled but packages/cli/daemon/specs/rigs/launch/conveyor/rig.yaml is missing. scripts/build-package.sh assembles BOTH dist + specs; an assembled bundle without specs is an incomplete artifact that would break \`rig up conveyor\`. Re-run scripts/build-package.sh.`,
   );
+  const vendoredSpec = fs.readFileSync(vendoredSpecPath, "utf-8");
 
   // Slice 01's review feedback fix: review.reviewer → build.builder is
   // can_observe (NOT delegates_to). A vendored spec that still says
@@ -134,10 +141,17 @@ test("baseline-fix-packaging guard: vendored daemon dist+specs match source when
   }
 
   // Same check for the conveyor spec (the slice-01-aware artifact).
+  // Per guard verdict qitem-20260518055713: when the bundle is
+  // assembled and source has the spec, vendored MUST have it too —
+  // missing = fail, not skip.
   const conveyorRel = "rigs/launch/conveyor/rig.yaml";
   const srcConveyor = path.join(SRC_SPECS, conveyorRel);
   const vendConveyor = path.join(VEND_SPECS, conveyorRel);
-  if (fs.existsSync(srcConveyor) && fs.existsSync(vendConveyor)) {
+  if (fs.existsSync(srcConveyor)) {
+    assert.ok(
+      fs.existsSync(vendConveyor),
+      `Source conveyor spec exists but vendored copy at packages/cli/daemon/specs/${conveyorRel} is missing. Assembled bundle is incomplete; run scripts/build-package.sh to assemble both dist + specs.`,
+    );
     assert.strictEqual(
       fs.readFileSync(vendConveyor, "utf-8"),
       fs.readFileSync(srcConveyor, "utf-8"),