test(app-shell): warm @objectstack/lint at module scope so the DraftChangesPanel security-link case passes alone (#26241)

<!-- claude-projects-attribution: {"github_login":"os-steve"} -->
_Requested by **Steve** · [project
thread](https://claude.ai/code/project/chan_01FdL1XeUyvVNxLreh3F4Qi9?thread=cmsg_01FdL1XeUyvVNxLreh3F4Qi9ANQiMBXfkrMGxoJLG8sWEf)_

Fixes #26199

Clause-②: no (one test file)
Metadata-protocol: none

## What it was

Neither a lost block nor a fixture that predates #26056. The security
block in `DraftChangesPanel` renders only after `securityPostureLint`
resolves its function-body `import('@objectstack/lint')`.
`DraftChangesPanel.securityLink.test.tsx` never warmed that module, so
when the file ran alone the first transform was paid inside the first
case's 1000 ms `findByTestId` window. The second case passed because the
module was cached by then. The sibling
`DraftChangesPanel.securityProblems.test.tsx` already warms the same
specifier at module scope for exactly this reason (ui/AGENTS.md, test
discipline: an unbounded module load counted inside a bounded window).

All readings below are the one file run alone, from `ui/`, `vitest run
--maxWorkers=2
packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityLink.test.tsx`,
under the shared verify lock.

| Tree | Result | When the case gave up / the block appeared |
|---|---|---|
| `main` 7111e14, unchanged | 3/3 red | gave up at ~1089 ms |
| 7111e14 with #26056's panel hunk reverse-applied | 1/3 red, 2/3 green
| gave up at 1097 ms on the red run |
| 7111e14, throwaway probe with a 10 s window (not committed) | 3/3
green | block at 980 / 936 / 1175 ms |
| 7111e14 plus the module-scope import | 5/5 green | block at 27 / 20 /
22 ms (probe) |
| this branch, head 0f7f928 on base f143cd8 | 3/3 green | |
| same, with the import line deleted (`scripts/ablation-replace.mjs`,
restored, blob equals HEAD) | 2/3 red | gave up at 1085 / 1109 ms |

So the panel renders the block every time; #26056 only moved the margin.
The block arriving at about one second is the whole defect.

## The change

One module-scope `import '@objectstack/lint';` with a comment, in
`ui/packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityLink.test.tsx`.
Same specifier as the component, so its dynamic import resolves from the
ESM cache. The cost moves into the file's import phase, which no test or
hook timeout bounds, so the result no longer depends on what ran before
it in the shard. Assertions and timeouts are untouched; nothing is
skipped or quarantined.

## Tests

- The file alone: 3/3 green at 0f7f928 (table above).
- Every `DraftChangesPanel` file in `preview/__tests__`: `vitest run
--maxWorkers=2
packages/app-shell/src/preview/__tests__/DraftChangesPanel` gave 18
files and 96 tests passed. The full app-shell package is left to CI
`Test Core`, a declared narrowing.
- The merge of `origin/main` (head 99fa874) touched nothing under
`ui/packages/app-shell`, `packages/lint`, `packages/spec` or
`pnpm-lock.yaml`, so the readings carry over.

## Gates

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 24 commands at 0f7f928. All 24
exited 0. `--ran` reconciliation: 24 derived, 24 run, 0 NOT-MEASURED,
all with recorded exit codes. Type-check lanes are left to CI.

## Changeset

None, with `skip-changeset`: the diff is one file under `__tests__/`,
which the app-shell build excludes from `dist`, and `files` ships only
`dist`, `src/styles.css`, README, CHANGELOG and LICENSE. An
empty-frontmatter changeset is refused here by
`scripts/check-empty-changeset.mjs`.

## Acceptance notes

- Off the sdui record: app-shell is not a registry package and no source
changed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_014sjSLK4TBwwZM9jfTM2nEN

---
_Generated by [Claude
Code](https://claude.ai/code/session_014sjSLK4TBwwZM9jfTM2nEN)_

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Steve Jobs <steve@objectstack.ai>

Author: 3 people

ui/packages/app-shell/src/preview/__tests__/DraftChangesPanel.securityLink.test.tsx

@@ -40,6 +40,12 @@ vi.mock('@object-ui/i18n', async (importOriginal) => {
 
 import { DraftChangesPanel } from '../DraftChangesPanel';
 import { SurfaceDeepLinkProvider } from '../../views/studio-design/surfaceDeepLinkChannel';
+// Warm the lint package at module scope, as the sibling security suite does:
+// `securityPostureLint` loads it with a function-body `import('@objectstack/lint')`,
+// and run alone, that first transform lands inside the first case's 1000 ms
+// `findBy` window (the block arrived at ~1 s). Same specifier, so the
+// component's own dynamic import resolves from the cache.
+import '@objectstack/lint';
 
 afterEach(() => {
   cleanup();