feat(scripts): check-override-consistency 增加 override 消费者体检与自失效上界报告

.github/workflows/validate-deps.yml

@@ -72,9 +72,17 @@ jobs:
       # another (the 15.1.0 quickstart shipped exactly that: plugin-auth
       # declared better-auth ^1.6.23 while CI ran the 1.7.0-rc.1 override,
       # and every fresh project 500'd on auth).
+      #
+      # The same run also prints two informational censuses (#6046): overrides
+      # nothing in the dependency tree consumes, and selectors whose upper
+      # bound excludes their own target (#4961 / #5032). Both are REPORTS and
+      # never fail the job — an unconsumed override is a legitimate posture
+      # (#5835 ruling A). `--self-test` proves the check in both directions,
+      # so run the `check:override-consistency` chain rather than the bare
+      # script: a self-test nothing invokes is a phantom check.
       - name: Verify overrides are reflected in published manifests
-        run: node scripts/check-override-consistency.mjs
-          
+        run: pnpm check:override-consistency
+
       # Fail the workflow if known vulnerabilities are found — enforces
       # security compliance before merging.
       #

package.json

@@ -55,6 +55,7 @@
     "check:objectui-pin-fresh": "node scripts/check-objectui-pin-fresh.mjs --self-test && node scripts/check-objectui-pin-fresh.mjs",
     "check:prerelease-pins": "node scripts/check-prerelease-pin-watch.mjs --self-test && node scripts/check-prerelease-pin-watch.mjs",
     "check:empty-changeset": "node scripts/check-empty-changeset.mjs --self-test && node scripts/check-empty-changeset.mjs",
+    "check:override-consistency": "node scripts/check-override-consistency.mjs --self-test && node scripts/check-override-consistency.mjs",
     "check:release-notes": "node scripts/check-release-notes.mjs",
     "check:release-body": "node scripts/release-github-releases.mjs --self-test",
     "check:node-version": "node scripts/check-node-version.mjs",