fix(ci): check:proto-reads fails on main — variant.ts guarded read is unlisted and its pre-#878 allowlist entry is stale #896

Problem

bun run check:proto-reads (the #865 prototype-chain regression gate, run in CI on Linux in .github/workflows/test.yml, "Check prototype-chain reads are dispositioned") fails on current main 580c277358. The gate's allowlist was written against the pre-#878 shape of variant.ts; PR #878 then changed that read to a multiline Object.hasOwn guard, and PR #883 (the #865 gate itself) merged afterwards carrying the now-stale entry. The guarded read is correct — the gate's bookkeeping is what is broken — so every CI run of the test workflow on main fails this step until the allowlist is updated.

Evidence (main 580c277358, verified this run)

• packages/core/src/variant.ts:30-37 — the current read is multiline:

  const protocol =
    model.package === undefined
      ? undefined
      : Object.hasOwn(PROTOCOLS, model.package)
        ? PROTOCOLS[model.package]
        : undefined

  The trimmed hit line ? PROTOCOLS[model.package] (variant.ts:36) matches the gate's P-A pattern (script/check-proto-reads.ts, PATTERNS) and is NOT in the allowlist.
• script/check-proto-reads.allowlist.txt:50 — the only variant.ts entry is the old single-line form:
  packages/core/src/variant.ts :: const protocol = model.package === undefined ? undefined : PROTOCOLS[model.package] :: tracked: #862, fix in flight on PR #878; migrate to ownValue when it lands …
  That exact line no longer exists in the source, so the entry is stale, and its disposition ("fix in flight on PR fix(core): read Variant PROTOCOLS table with an own-property guard #878") is also out of date: fix(core): read Variant PROTOCOLS table with an own-property guard #878 has merged and the read is now guarded at the site.
• Replicated the gate's exact scan/parse/stale/unlisted logic (scanSource, parseAllowlist, unlistedHits, staleEntries from script/check-proto-reads.ts) over packages/core/src at 580c277358: 45 hits, 44 allowlist entries, exactly 1 unlisted hit (variant.ts:36 above) and exactly 1 stale entry (the allowlist line above). No other file is affected.
• Merge order confirms the cause: d0dd344d84 (Variant own-property guard, PR fix(core): read Variant PROTOCOLS table with an own-property guard #878) landed before a5c18ea45e / merge 580c277358 (PR feat(core): shared own-property guard + prototype-chain read regression net #883, the audit(core): shared own-property guard + regression net for prototype-chain dictionary reads (#833 follow-up) #865 gate), whose allowlist still carried the pre-guard line.

Why it matters

A regression gate that is red on main trains everyone to ignore it — the exact failure mode #865/#833 built it to prevent — and it fails the Linux test workflow step for unrelated PRs until fixed. The fix is bookkeeping only; the underlying prototype-chain read is already correctly guarded.

Acceptance criteria

• script/check-proto-reads.allowlist.txt: replace the stale variant.ts entry with the current trimmed hit line from packages/core/src/variant.ts:36, with disposition "guarded: Object.hasOwn ternary at the same site (fix(core): Variant PROTOCOLS table reads through the prototype chain — a model package named "constructor" resolves to the Object function #862)".
• bun run check:proto-reads exits 0 on main ("All 45 prototype-chain read candidates … are dispositioned" or the then-current count).
• No source change to variant.ts (its Object.hasOwn guard is correct as-is), and no other allowlist entries added, removed, or reworded.
• CI test workflow's "Check prototype-chain reads are dispositioned" step is green.