tests: the journal reaches lichen only through lichen-ts #16

description: The journal's check.sh now checks that the journal reaches lichen only through lichen-ts. Its src/ and index.html may hold no fetch, XMLHttpRequest, WebSocket, EventSource or sendBeacon of their own, and no /api/ or /cms/api/ string. A failure names its file and line. The journal loading its own files from /cms/api/assets/ is the one exception.

The check is scripts/frontends-through-lichen-ts.py, a byte-for-byte copy of lichen.page's e2e/frontends-through-lichen-ts.py. It runs in that script's --frontend mode, together with its selftest:

• the journal as it is passes;
• a planted fetch("/cms/api/build") is caught by its file and line;
• src/ missing fails the check.

info:

• Unit: lichen.page's FRONTENDS-THROUGH-LICHEN-TS L4. Its L1 note says daily-journal runs the same check in its own repository.
• Parent: main at b98adef.
• The script is a copy of lichen.page s/477-lts-l4-tests at 0e569ec0, with the same sha256. It is copied because the journal's lichen-pin (ea1ef281) predates the check, and moving the pin is a unit of its own. When the pin moves past L4, check.sh can run the pinned checkout's script instead.
• The journal needed no source change: it already reaches lichen only through lichen-ts.
• Checks (run on this checkout; stdlib Python):
  • python3 scripts/frontends-through-lichen-ts.py --frontend .: OK, 2 files;
  • --selftest: OK, 3 checks;
  • bash -n check.sh: ok.
  • The rest of check.sh is unchanged.