Port fabricated-evidence tripwire to portico

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - tripwire
parent: KNUCK-A045
---

## Context

Port the fabricated-evidence tripwire (studio KNUCK-A028/A029/A030) to portico. Files to copy from operant-health/operant-studio at HEAD as of [REDACTED-DOB]:

- `.github/workflows/no-scaffolding-stub.yml` (2880 bytes) -- job name is `Reject fabricated verification evidence`
- `scripts/check-scaffolding-stub.ts` (5216 bytes) -- SUT
- `scripts/scaffolding-stub-patterns.json` (1882 bytes) -- pattern source of truth
- `scripts/__tests__/check-scaffolding-stub.test.ts` (3651 bytes) -- unit tests
- `scripts/__fixtures__/scaffolding-stub-tripwire/{pos,neg}/` -- positive/negative fixtures

On portico, verify:

1. `pnpm tsx` works with existing package.json + turborepo layout (portico already uses tsx per its ci.yml).
2. The workflow's paths do not need repo-specific tweaks (the tripwire script uses `process.cwd()` and scans changed files relative to repo root, so should be portable).
3. Fixtures under `scripts/__fixtures__/scaffolding-stub-tripwire/pos/` do not accidentally hit any portico `.gitignore` rule.

## Acceptance Criteria

- [ ] PR on portico that copies the six files + fixtures, no other changes
- [ ] The workflow file lands and runs green on the PR itself (i.e., the tripwire does not falsely fire on the port PR)
- [ ] The self-test job runs green (`scripts/__tests__/check-scaffolding-stub.test.ts`)
- [ ] Follow-up separate PR (KNUCK-A045d) adds the context to portico's required-status-checks list
- [ ] `no-ticket` label applied since portico's trailer check doesn't accept KNUCK yet (this ticket blocks on KNUCK-A045c or uses the escape hatch)

## Provenance

Parent: KNUCK-A045. Blocks: KNUCK-A045d.