fix(ci,scripts): post-merge review items M1/M2/A3/A4

- enforce-pr-target.yml: drop the no-op split/trim/join on the comment body
  (array join already produces the final text)
- ci-quality-gate.yml: safety findings now emit a workflow warning instead
  of being silently absorbed by '|| true'
- check_paths.py: fnmatch import hoisted to module level
- smoke_scripts.py: stale exception entries now fail the gate (exit 3) so
  scripts/smoke_exceptions.txt stays tidy

https://claude.ai/code/session_019AJddAL1NADWMXsy1qNPQF

.github/workflows/ci-quality-gate.yml

@@ -124,7 +124,9 @@ jobs:
           fi
           for f in $files; do
             echo "Auditing $f"
-            safety check --full-report --file "$f" || true
+            if ! safety check --full-report --file "$f"; then
+              echo "::warning file=$f::safety found vulnerabilities in $f (advisory)"
+            fi
           done
 
       - name: Markdown link spot-check

.github/workflows/enforce-pr-target.yml

@@ -60,7 +60,7 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: pr.number,
-              body: message.split('\n').map(l => l.trim()).join('\n'),
+              body: message,
             });
 
             if (!isMaintainer) {

scripts/check_paths.py

@@ -19,6 +19,7 @@ Usage:
 """
 
 import argparse
+import fnmatch
 import json
 import os
 import re
@@ -135,7 +136,6 @@ def load_allowlist(repo_root: str):
 
 
 def allowlisted(rel_file: str, candidate: str, allowlist) -> bool:
-    import fnmatch
     return any(
         fnmatch.fnmatch(rel_file, fg) and fnmatch.fnmatch(candidate, cg)
         for fg, cg in allowlist

scripts/smoke_scripts.py

@@ -146,11 +146,16 @@ def main(argv=None):
                 print(f"  {f['file']}")
                 print(f"      {f['detail']}")
         if stale_exceptions:
-            print("\nWARNING: exceptions listing files that no longer exist:")
+            print("\nERROR: exceptions listing files that no longer exist")
+            print("(remove them from scripts/smoke_exceptions.txt):")
             for f in stale_exceptions:
                 print(f"  {f}")
 
-    return 1 if failures else 0
+    if failures:
+        return 1
+    if stale_exceptions:
+        return 3
+    return 0
 
 
 if __name__ == "__main__":