fix(audit): distinguish missing command-status fixture from contract violation (#8339)

A declared command_status_contracts scenario whose golden fixture file is
missing or unreadable was reported as a CommandStatusContractViolation —
the same finding kind as genuine status-contract drift (wrong field
values, invalid envelope semantics). A missing fixture is test-data
hygiene, not a contract violation.

Add a distinct CommandStatusFixtureMissing finding kind (serialized as
command_status_fixture_missing) with a non-"violates contract"
description, and emit it from the missing/unreadable-fixture branch. Wire
the new variant through all_names, the confidence map (structural), and
the detector descriptor's declared findings so --only routing works.

Resolves #8300.

Author: chubes4

src/core/code_audit/conventions/mod.rs

@@ -444,6 +444,10 @@ pub enum AuditFinding {
     UnboundedOutputCapture,
     /// Declared command scenario output differs from its expected status contract.
     CommandStatusContractViolation,
+    /// A declared command-status scenario references a golden fixture file that
+    /// is missing or unreadable. This is test-data hygiene (write or remove the
+    /// fixture), distinct from an actual status-contract violation.
+    CommandStatusFixtureMissing,
     /// A command-layer module accumulates orchestration/business logic that
     /// should live in a core service. Command modules are expected to stay thin
     /// adapters (argument parsing, typed request construction, output
@@ -522,6 +526,7 @@ impl AuditFinding {
             "non_portable_artifact_path",
             "unbounded_output_capture",
             "command_status_contract_violation",
+            "command_status_fixture_missing",
             "thin_command_adapter_violation",
         ]
     }

src/core/code_audit/detectors/command_status_contracts.rs

@@ -52,7 +52,7 @@ pub(in crate::core::code_audit) fn run(
     for scenario in &config.scenarios {
         let fixture = root.join(&scenario.file);
         let Ok(content) = std::fs::read_to_string(&fixture) else {
-            findings.push(finding(
+            findings.push(fixture_missing_finding(
                 &scenario.file,
                 &scenario.id,
                 "scenario fixture is missing or unreadable".to_string(),
@@ -363,6 +363,27 @@ fn finding(file: &str, scenario_id: &str, description: String, suggestion: Strin
     }
 }
 
+/// A declared scenario's golden fixture file is missing or unreadable. This is
+/// test-data hygiene, not a status-contract violation, so it gets its own kind
+/// and a non-"violates contract" description.
+fn fixture_missing_finding(
+    file: &str,
+    scenario_id: &str,
+    description: String,
+    suggestion: String,
+) -> Finding {
+    Finding {
+        convention: "command_status_contracts".to_string(),
+        severity: Severity::Warning,
+        file: file.to_string(),
+        description: format!(
+            "Command status scenario '{scenario_id}' fixture unavailable: {description}"
+        ),
+        suggestion,
+        kind: AuditFinding::CommandStatusFixtureMissing,
+    }
+}
+
 fn json_value_label(value: &serde_json::Value) -> String {
     serde_json::to_string(value).unwrap_or_else(|_| "<unserializable>".to_string())
 }
@@ -574,6 +595,33 @@ mod tests {
         assert!(findings[0].suggestion.contains("successful empty results"));
     }
 
+    #[test]
+    fn missing_fixture_reports_distinct_kind_not_contract_violation() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        // No fixture file is written, so the declared scenario's golden fixture
+        // is missing.
+        let config = CommandStatusContractConfig {
+            required_commands: Vec::new(),
+            required_output_error_commands: Vec::new(),
+            scenarios: vec![scenario(
+                "review-artifact-golden",
+                Some("review"),
+                "does-not-exist.json",
+                None,
+                false,
+                [("/success", serde_json::json!(false))],
+            )],
+        };
+
+        let findings = run(dir.path(), &config);
+        assert_eq!(findings.len(), 1);
+        let finding = &findings[0];
+        assert_eq!(finding.kind, AuditFinding::CommandStatusFixtureMissing);
+        assert_ne!(finding.kind, AuditFinding::CommandStatusContractViolation);
+        assert!(finding.description.contains("fixture unavailable"));
+        assert!(!finding.description.contains("violates contract"));
+    }
+
     fn scenario<const N: usize>(
         id: &str,
         command: Option<&str>,

src/core/code_audit/execution_plan.rs

@@ -491,7 +491,10 @@ const DETECTOR_DESCRIPTORS: &[DetectorDescriptor] = &[
     },
     DetectorDescriptor {
         id: "command_status_contracts",
-        findings: &[AuditFinding::CommandStatusContractViolation],
+        findings: &[
+            AuditFinding::CommandStatusContractViolation,
+            AuditFinding::CommandStatusFixtureMissing,
+        ],
         access: DetectorAccess::RootOnly,
         runtime: DetectorRuntime::Generic(GenericDetectorRunner::CommandStatusContracts),
         timing_id: "detector.command_status_contracts",

src/core/code_audit/findings.rs

@@ -184,7 +184,8 @@ impl AuditFinding {
             | AuditFinding::StaleDocReference
             | AuditFinding::UnwiredNestedRustTest
             | AuditFinding::NonPortableArtifactPath
-            | AuditFinding::CommandStatusContractViolation => FindingConfidence::Structural,
+            | AuditFinding::CommandStatusContractViolation
+            | AuditFinding::CommandStatusFixtureMissing => FindingConfidence::Structural,
 
             // Depends on cross-file reference resolution or declared ownership maps.
             AuditFinding::UnusedParameter