fix(miner): restore the strict flat-only pack-safety allowlist

[JSONbored]

Summary

• fix(miner): accept lib/ subdirectory modules in the package checker #3778 widened scripts/check-miner-package.mjs's ALLOWED regex to accept one level of subdirectory under lib/, to accommodate the calibration module's nested lib/calibration/{index,types}.{js,d.ts} layout added by chore(miner): scaffold calibration module types (#2332) #3704.
• fix(miner): flatten calibration module to match the flat lib/ convention #3772 (merged 4 minutes earlier, independently fixing the same main-red CI break) took the opposite approach: it flattened that module to lib/calibration.js + lib/calibration-types.js, matching every other module in packages/gittensory-miner/lib/.
• With the nested directory gone (verified: git ls-tree -r origin/main -- packages/gittensory-miner/lib/ shows zero subdirectory entries), fix(miner): accept lib/ subdirectory modules in the package checker #3778's widening is now dead weight — it permanently weakens a security-relevant pack-safety allowlist (the only guard against an arbitrary nested file sneaking into the published npm package) for zero remaining benefit.
• Restore the strict flat-only pattern. Turn the now-obsolete "accepts a one-level subdirectory" test into a rejection test instead, so a future nested lib/ file is caught here rather than requiring another regex widening.

No issue filed — small, self-evident cleanup of a redundant, just-merged change.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused — one regex revert + one test update, nothing else.
• This follows CONTRIBUTING.md and does not touch site/, CNAME, or GitHub Pages.
• No issue linked; the summary explains why.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npx vitest run test/unit/check-miner-package.test.ts — 8/8 passed, including the real-workspace-package test and both rejection cases (one-level and two-level nesting)
• npm audit --audit-level=moderate
• npm run test:coverage in full — not run; scripts/** is excluded from codecov/patch (only src/** is measured), and the directly affected test file was run in full above

If any required check was skipped, explain why:

• Full coverage run skipped: this PR only touches scripts/check-miner-package.mjs and its dedicated test file, neither under src/**.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• No auth/cookie/CORS/GitHub App/Cloudflare/session changes.
• No API/OpenAPI/MCP behavior changed.
• No UI changes.
• This PR tightens, not weakens, a security-relevant allowlist.

Notes

• Companion to fix(miner): flatten calibration module to match the flat lib/ convention #3772 and fix(miner): accept lib/ subdirectory modules in the package checker #3778. Two independently-authored fixes for the same bug landed within minutes of each other; this PR reconciles them by keeping the more conservative one (flatten the module, keep the allowlist strict) and removing the now-unnecessary permissiveness from the other.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.29%. Comparing base (ede8961) to head (8fdd4de).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3781   +/-   ##
=======================================
  Coverage   93.29%   93.29%           
=======================================
  Files         317      317           
  Lines       32368    32368           
  Branches    11872    11872           
=======================================
  Hits        30199    30199           
  Misses       1537     1537           
  Partials      632      632           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.