fix(devx): give checklist-select.mjs a main(), so importing selectItems does not kill the importer

This one was the fatal shape in the ledger. Its top-level CLI ran on import:
importing it for `selectItems` — the pure resolver the checklist-test skill's
front half is built on — printed a usage block to the importer's stderr and
called process.exit(2) mid-import. The probe's own sentinel never printed.

The self-test block becomes selfTest(), the CLI block becomes main(), and both
run only under isEntrypoint(import.meta.url). No executable line changed other
than its enclosing scope; the process.exit() calls stay exactly where they were.

Verified byte-for-byte against the pristine base tree, since a main() extraction
moves executable lines where a wrap does not — stdout, stderr and exit code all
cmp-clean on six legs: default (usage, exit 2), --self-test, `all --json`,
`area:approvals`, `all --include-blocked`, and `nope.xxx` (the no-match exit-1
path). Import probe with clean argv: sentinel only, empty stderr, exit 0.
check:entry-guard named it STALE before its ledger line went; ledger 9 -> 8.

Author: claude

scripts/check-entry-guard.mjs

@@ -463,7 +463,6 @@ const KNOWN_IMPORT_UNSAFE = new Set([
   'scripts/check-error-status-conformance.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/checklist-select.mjs',
   'scripts/objectui-range.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',

scripts/checklist-select.mjs

@@ -36,6 +36,7 @@
 
 import { readdirSync, readFileSync, existsSync } from 'node:fs';
 import { join, basename, dirname } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname;
 const AREAS_DIR = join(ROOT, 'docs/qa/platform-checklist/areas');
@@ -117,7 +118,7 @@ function isBlocked(it) {
 }
 
 // ── self-test ────────────────────────────────────────────────────────────────
-if (process.argv.includes('--self-test')) {
+function selfTest() {
   const FIX = [
     { id: 'a.one', status: 'active', priority: 'P0', surface: 'browser', since: 'v16', source: ['packages/foo/bar.ts'] },
     { id: 'a.two', status: 'active', priority: 'P1', surface: 'api', since: 'v16.1', source: ['#3358'], blocked: { by: 'fixture', ref: '#1' } },
@@ -153,39 +154,49 @@ if (process.argv.includes('--self-test')) {
 }
 
 // ── CLI ──────────────────────────────────────────────────────────────────────
-const args = process.argv.slice(2);
-const json = args.includes('--json');
-const includeBlocked = args.includes('--include-blocked');
-const selector = args.find((a) => !a.startsWith('--'));
-
-if (!selector) {
-  console.error('usage: node scripts/checklist-select.mjs <selector> [--json] [--include-blocked]');
-  console.error('       selectors: <id> | area:<a> | capability:<k> | priority:P0 | surface:api | since:vN | file:<path> | all');
-  process.exit(2);
-}
-if (!existsSync(AREAS_DIR)) {
-  console.error(`checklist-select: ${AREAS_DIR} not found`);
-  process.exit(1);
-}
+function main() {
+  const args = process.argv.slice(2);
+  const json = args.includes('--json');
+  const includeBlocked = args.includes('--include-blocked');
+  const selector = args.find((a) => !a.startsWith('--'));
 
-const items = loadItems();
-const coverage = existsSync(COVERAGE) ? JSON.parse(readFileSync(COVERAGE, 'utf8')) : { metadataKinds: {} };
-let matched = selectItems(selector, items, coverage);
-const droppedBlocked = includeBlocked ? [] : matched.filter(isBlocked);
-if (!includeBlocked) matched = matched.filter((it) => !isBlocked(it));
+  if (!selector) {
+    console.error('usage: node scripts/checklist-select.mjs <selector> [--json] [--include-blocked]');
+    console.error('       selectors: <id> | area:<a> | capability:<k> | priority:P0 | surface:api | since:vN | file:<path> | all');
+    process.exit(2);
+  }
+  if (!existsSync(AREAS_DIR)) {
+    console.error(`checklist-select: ${AREAS_DIR} not found`);
+    process.exit(1);
+  }
 
-if (json) {
-  process.stdout.write(JSON.stringify(matched.map((it) => ({ id: it.id, priority: it.priority, surface: it.surface, since: it.since, revision: it.revision })), null, 2) + '\n');
-}
+  const items = loadItems();
+  const coverage = existsSync(COVERAGE) ? JSON.parse(readFileSync(COVERAGE, 'utf8')) : { metadataKinds: {} };
+  let matched = selectItems(selector, items, coverage);
+  const droppedBlocked = includeBlocked ? [] : matched.filter(isBlocked);
+  if (!includeBlocked) matched = matched.filter((it) => !isBlocked(it));
 
-console.error(`\nselector: ${selector} → ${matched.length} runnable item(s)${droppedBlocked.length ? ` (${droppedBlocked.length} blocked, hidden — pass --include-blocked)` : ''}\n`);
-for (const it of matched) {
-  console.error(`  ${it.priority}  ${String(it.surface).padEnd(8)}  ${it.id}${isBlocked(it) ? '  [BLOCKED]' : ''}`);
-}
-if (droppedBlocked.length) {
-  console.error(`\n  hidden (blocked): ${droppedBlocked.map((i) => i.id).join(', ')}`);
+  if (json) {
+    process.stdout.write(JSON.stringify(matched.map((it) => ({ id: it.id, priority: it.priority, surface: it.surface, since: it.since, revision: it.revision })), null, 2) + '\n');
+  }
+
+  console.error(`\nselector: ${selector} → ${matched.length} runnable item(s)${droppedBlocked.length ? ` (${droppedBlocked.length} blocked, hidden — pass --include-blocked)` : ''}\n`);
+  for (const it of matched) {
+    console.error(`  ${it.priority}  ${String(it.surface).padEnd(8)}  ${it.id}${isBlocked(it) ? '  [BLOCKED]' : ''}`);
+  }
+  if (droppedBlocked.length) {
+    console.error(`\n  hidden (blocked): ${droppedBlocked.map((i) => i.id).join(', ')}`);
+  }
+  if (matched.length === 0) {
+    console.error('  (nothing matched — check the selector; try `all` or `area:<name>`)');
+    process.exit(1);
+  }
 }
-if (matched.length === 0) {
-  console.error('  (nothing matched — check the selector; try `all` or `area:<name>`)');
-  process.exit(1);
+
+// The dispatch runs only when node ran THIS file. Imported for `selectItems`
+// (the skill's front half is a pure resolver), the old top-level CLI printed a
+// usage block to the importer's stderr and killed it with exit 2 mid-import.
+if (isEntrypoint(import.meta.url)) {
+  if (process.argv.includes('--self-test')) selfTest();
+  main();
 }