Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)

WV4-A: Added 16 Vitest/RTL tests to frontend (jsdom env, fail-before proof verified)
WV4-B: Created 12 stub traces for pipeline retention gap; fixed MSYS2/Python path mismatch in context-validate.sh; run-casan4-harness-tests.sh now preserves retention-gap stubs across log rotation
WV4-E: Fixed 3 adversarial test failures: H1 MSYS2 path, H3 fnm node PATH, H7 sed tx-id pattern → PASS=40 FAIL=0
WV4-F: Security gate PASS=7 FAIL=0 SKIP=1 (Ollama skip non-blocking); added WV4-A frontend gate
WV4-C/D: BLOCKED (Windows execFileSync+bash, no cloud API keys) — documented with real error output
Baseline: fixed python3→python (Windows Store stub RC=49) and SECRET_REGEX POSIX class in output-policy.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/security-gate.sh

@@ -32,5 +32,17 @@ else
   echo "  GATE SKIP  model router + red-team + judge-gate (Ollama tunnel down)"; SKIP=$((SKIP+1))
 fi
 
+# Wave 4 additions
+FNM_NODE_DIR="$HOME/AppData/Roaming/fnm/node-versions"
+if [[ -d "$FNM_NODE_DIR" ]]; then
+  NODE_BIN=$(find "$FNM_NODE_DIR" -name "node.exe" -maxdepth 4 2>/dev/null | sort -V | tail -1)
+  [[ -n "$NODE_BIN" ]] && export PATH="$(dirname "$NODE_BIN"):$PATH"
+fi
+if command -v node >/dev/null 2>&1; then
+  run "frontend runtime tests (WV4-A)"  bash -c "cd '$ROOT' && npm test -w frontend"
+else
+  echo "  GATE SKIP  frontend runtime tests (node not in PATH)"; SKIP=$((SKIP+1))
+fi
+
 echo "== verdict: PASS=$PASS FAIL=$FAIL SKIP=$SKIP =="
 [[ "$FAIL" -eq 0 ]] || exit 1