Remove obsolete process audit exception

- remove the Playwright shell:true exception after the hardened launcher landed\n- require repository and CLI audits to report zero exceptions\n- retain exact exception schema and stale-drift coverage\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: f349adcb-b52e-4060-95aa-b0f4e13841ac

Author: priyanshu92

scripts/tests/validate-secure-process-execution.test.js

@@ -179,10 +179,11 @@ test('audited exception schema requires a review reason', () => {
   );
 });
 
-test('repository-wide audit is clean apart from the exact reviewed exception', () => {
+test('repository-wide audit is clean with no audited exceptions', () => {
   const result = auditRepository(REPOSITORY_ROOT);
   assert.deepEqual(result.findings, []);
-  assert.deepEqual(result.audited, AUDITED_EXCEPTIONS);
+  assert.deepEqual(AUDITED_EXCEPTIONS, []);
+  assert.deepEqual(result.audited, []);
   assert.ok(result.files.length > 100, 'expected a repository-wide production scan');
 });
 
@@ -192,6 +193,6 @@ test('CLI audit emits actionable diagnostics and succeeds for the repository', (
   });
 
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /AUDITED plugins\/power-pages\/scripts\/launch-playwright-mcp\.js/);
-  assert.match(result.stdout, /validation passed \(\d+ production files, 1 audited exception\)/);
+  assert.doesNotMatch(result.stdout, /^AUDITED /m);
+  assert.match(result.stdout, /validation passed \(\d+ production files, 0 audited exceptions\)/);
 });

scripts/validate-secure-process-execution.js

@@ -63,18 +63,9 @@ const EXCLUDED_DIRECTORY_NAMES = new Set([
   'node_modules',
 ]);
 
-// The separate Playwright hardening PR #383 owns this legacy launcher. Matching
-// uses the exact path, rule, callee, and whitespace-independent call tokens.
-// Any call drift produces both the original finding and a stale-exception error.
-const AUDITED_EXCEPTIONS = Object.freeze([
-  Object.freeze({
-    path: 'plugins/power-pages/scripts/launch-playwright-mcp.js',
-    rule: 'shell-true',
-    callee: 'spawn',
-    call: "spawnFn ( 'npx' , buildMcpArgs ( browser ) , { stdio : 'inherit' , shell : true , } )",
-    reason: 'Legacy Playwright launcher is removed by PR #383; delete this exception when that stacked change lands.',
-  }),
-]);
+// Exceptions must remain rare, exact, and removable. The current production
+// tree needs none; drift behavior stays covered by synthetic tests below.
+const AUDITED_EXCEPTIONS = Object.freeze([]);
 
 function decodeStringLiteral(raw) {
   if (typeof raw !== 'string' || raw.length < 2) return null;