test: repair architecture catalog fixture and cover the sourceUrl, id and asset rules from #334

[hivecommons-hive]

Test Improvement

npm run test:unit is red on main. .github/workflows/ci.yml runs it on every
pull_request, so the "Validate repository" check is failing on every open PR,
not just one.

dc5fe09 (#334) added three mandatory rules to scripts/validate-architectures.mjs
— sourceUrl must be an https: URL, id must be a lowercase slug, and every
asset must resolve inside static/img/architectures/ — without updating the test
fixtures. The validRecord fixture has no sourceUrl, so the two tests that
assert status === 0 fail.

This PR touches tests/validate-architectures.test.mjs only. No production code.

Changes

• Add sourceUrl to the validRecord fixture, repairing accepts a valid catalog
  and accepts records without an assets array.
• Cover the sourceUrl rule fix: validate architecture catalog sourceUrl scheme and asset containment (scripts/validate-architectures.mjs) #334 introduced: absent, http:, javascript:,
  unparseable, and non-string.
• Cover the id slug rule with a rejected id.
• Cover asset containment: outside the prefix, .. traversal, and non-string.

Verification

Clean npm ci, node v26.8.2, at 60ddab0:

	tests	pass	fail
before	345	341	2
after	354	352	0

npx prettier --check tests/validate-architectures.test.mjs passes.

The reported percentage for scripts/validate-architectures.mjs stays at
90.74% / 29.41%: these tests drive the validator through runScriptWithFixtures,
which spawns a subprocess, and node --test coverage discards subprocess data.
That attribution gap is #224 (PR #227/#225 territory), not something this PR claims
to fix — the branches are genuinely exercised, just not counted.

Overlap with open PRs

Open PR #212 also edits tests/validate-architectures.test.mjs, but only appends
MDX-active-content tests at end of file, and those tests reuse the same unfixed
validRecord — merging #212 alone will not turn CI green, and it will inherit the
fix from here. This PR inserts its tests before rejects assets missing from static/, above #212's append point, so the two should not conflict textually.
No other open PR touches this file.

Related Issue

Closes #397

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.