Restore the CSV negative control that a git reset --hard silently deleted

The previous commit claimed to add a negative control to the byte-identity
check. It did not. The control never reached GitHub, CI went green anyway
because there was nothing there to fail, and the commit message asserted a
guard that did not exist.

Cause: while testing the pre-commit hook's own control, the cleanup line was
`git commit --allow-empty && git reset --hard HEAD~1`. `reset --hard` discards
working-tree changes, and the edit to this workflow was uncommitted at the
time. The fixture teardown ate the feature.

Third time today a destructive git command used as test cleanup destroyed real
uncommitted work -- twice `git checkout -- <file>` reverting a fix along with
an injected fixture, now `reset --hard`. Convenience git commands take a wider
scope than the intent behind them, and none of the three announced what they
removed.

The failure this produced is exactly the one the control exists to prevent: a
check that is green because it checks nothing. It was found by grepping the
pushed file for the control's own output string rather than trusting a green
run -- CI passing is not evidence that the thing you added is running.

Teardown for a mutation fixture is now `cp` from a backup, never `checkout`,
`reset` or `clean`.

Author: espressolee

.github/workflows/ci.yml

@@ -60,6 +60,24 @@ jobs:
             git --no-pager diff -- data/labels.csv | head -40
             exit 1; }
           echo "OK: regenerating leaves labels.csv byte-identical"
+          # Negative control. Byte-identity is trivially true if the extractor
+          # reads the CSV rather than the Markdown -- the check would then be
+          # green forever and catch nothing, a hypothesis that is its own
+          # conclusion. Mutate the SOURCE and require the check to fail.
+          cp data/bandit-classification.md /tmp/bandit.bak
+          sed -i 's/^| 1465 |/| 9999 |/' data/bandit-classification.md
+          python3 tools/extract_labels.py >/dev/null
+          if git diff --quiet -- data/labels.csv; then
+            cp /tmp/bandit.bak data/bandit-classification.md
+            echo "::error::mutating the Markdown did not change labels.csv --"
+            echo "::error::the extractor is not reading the Markdown"
+            exit 1
+          fi
+          cp /tmp/bandit.bak data/bandit-classification.md
+          python3 tools/extract_labels.py >/dev/null
+          git diff --quiet -- data/labels.csv || {
+            echo "::error::restoring the Markdown did not restore labels.csv"; exit 1; }
+          echo "OK: the CSV really is derived from the Markdown"
 
       - name: the tables actually come from the CSV
         run: |