ci: derive the duplicate-source scan from Package.swift — it covered 4 of ~10 dirs

[JasonYeYuhe]

Caught in the act

A QA build failed today with the exact error this guard exists to prevent:

'LocalSessionServer 2.swift' — invalid redeclaration of 'LocalSessionServer'

The guard did catch that one — HelperSwift/Sources was on its hardcoded list. But the list had gone stale, and six more duplicates were sitting unseen in HelperSwift/Tests.

Enumerating every Package.swift shows the four literal paths covered 4 of ~10 compiled directories. Unscanned: HelperSwift/Tests, SensorProbe/Tests, both MachineRootHelper dirs, and CLI Pulse Bar/codexbar. SwiftPM compiles Tests/ exactly as it compiles Sources/.

before:  1 of 7 duplicates reported
after:   7 of 7

A hardcoded allowlist of build inputs is the same trap as the QA bundle-id allowlist and the UserDefaults migration prefixes — adding a package silently drops it out of coverage and nothing says so. The list is now discovered from Package.swift locations, so a new package is covered the day it lands.

An empty discovery result now fails rather than silently passing: "scanned nothing" and "found nothing" would otherwise be the same green tick.

Forensics, since the origin has been "unknown" for weeks

fact	value
duplicate birth & mtime	2026-07-23 — older than the original (2026-08-03)
byte-identical?	No — 58,580 vs 59,716
diff direction	20 lines only in the original, zero only in the duplicate
xattrs	none — no fileprovider, no provenance
present in .claude/worktrees?	absent from all four

So it carries no unique work — deleting loses nothing, which I checked before removing, as the guard's own message instructs.

Two theories are now positively excluded rather than merely doubted:

• iCloud — no fileprovider xattr on the specimen, and per fix: the codesign detritus was never iCloud — correcting my own attribution #444 Desktop & Documents sync is off and ~/Documents is a plain directory.
• Parallel git worktrees — the file is absent from all four.

Origin still unidentified. But that's two fewer dead ends for the next investigation.

Verification

• All 7 quarantined to a backup before deletion.
• swift test --package-path HelperSwift → 719 tests, 0 failures afterwards.
• The QA build that started this now succeeds.
• Guard re-run on the cleaned tree → exit 0.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.