docs(devices): document fleet.ignored in the agents-yaml schema; repair the profiles.test state mock (RUSH-3062)

[muqsitnawaz]

docs + test-only: two leftovers from the RUSH-3062 fleet.ignored move (42e1ff3). No behavior change.

What changed

• apps/cli/schema/agents-yaml.schema.json — documents the fleet.ignored entries ({ name, ignoredAt, ignoredOn }, all three required) so the yaml-language-server integration and editors know the key the CLI now writes.
• apps/cli/src/lib/browser/profiles.test.ts — the ../state.js mock now exports getDevicesIgnoredPath. Since the move, config-migration.ts imports it (config-migration.ts:47), and the missing mock export made every test in this file throw inside the mock — caught by ensureDeviceConfigMigrated and logged as device config migration failed noise (observed on the main CI run for feat(devices): move the discovery ignore-list into tracked central agents.yaml (RUSH-3062) #2947), with the migration never actually running in those processes.

No changelog fragment: docs-only + test-only, and the fleet.ignored key itself shipped with its own entry (.changelog/next/RUSH-3062-ignore.md).

Verification

• profiles.test.ts: 93/93 green, no migration-failure noise; schema JSON parses.

Ticket: RUSH-3062

[muqsitnawaz]

VERDICT: APPROVE

Non-author review (automated reviewer paused per #1767). Docs + test-only diff, 2 files, +14/-0. All claims verified against origin/main.

Schema entry matches IgnoredDeviceEntry

apps/cli/src/lib/fleet/types.ts on origin/main (lines 96-103):

export interface IgnoredDeviceEntry {
  /** Tailscale node name the user dismissed. */
  name: string;
  /** ISO-8601 timestamp of the dismissal. */
  ignoredAt: string;
  /** machineId() of the box the dismissal was made on. */
  ignoredOn: string;
}

The new fleet.ignored schema entry (apps/cli/schema/agents-yaml.schema.json) declares exactly these three properties, all in required, all "type": "string" — shape matches. node -e "JSON.parse(...)" on the full schema file: valid JSON. The entry sits correctly inside fleet.properties next to discovery, whose own description already references ignored devices ("ignored devices remain hidden on every machine after user-repo sync"), so the doc surface is now consistent.

Mock gap is real on main, fix mirrors neighbors

• apps/cli/src/lib/devices/config-migration.ts:47 on origin/main imports getDevicesIgnoredPath from "../state.js" (import block lines 44-53), and calls it at line 191 (const legacyIgnoredPath = getDevicesIgnoredPath();).
• The pre-existing vi.mock("../state.js", () => ({...})) factory in profiles.test.ts (origin/main) listed getDevicesAutoLaunchPath and getDevicePinsPath but not getDevicesIgnoredPath — a full-factory mock, so the export was undefined, the call threw, and apps/cli/src/lib/device-config.ts:435 caught it: console.error(`device config migration failed (${err?.message ?? err}); a later run retries`).
• The added line getDevicesIgnoredPath: vi.fn(() => path.join(TEST_ROOT, 'ignored.json')) is placed between the two neighboring device-path mocks and mirrors their shape exactly. state.ts:660 confirms the real export exists: export function getDevicesIgnoredPath(): string { return path.join(getDevicesDir(), 'ignored.json'); }.

Conventions check (worktree-root AGENTS.md)

• No stubs/placeholders, no fallback band-aids — the fix is at the source (mock completeness), not a tolerated-bad-input branch.
• Tests exercise the real path — the file deliberately runs the real lib/device-config.ts (its own comment: "through the REAL lib/device-config.ts against this dir").
• Docs-in-sync: the schema is the doc surface here, and it now matches shipped code; no flag/command/behavior changed, so no CHANGELOG entry is owed (docs/test-only classification is accurate).
• Harness parity / capability table / scheduler rules: not applicable.

Test run (this branch)

Test Files  1 passed (1)
     Tests  93 passed (93)

grep -c "device config migration failed" on the output: 0 occurrences (previously logged by every test in the file via the caught TypeError).

One nit, non-blocking: the schema describes ignoredOn as "Machine id (hostname)" while the type comment says machineId() — the wording aligns closely enough; shape is what matters and it matches.