fix(farm): a raw NUL byte made the repo's largest source file unsearchable (#536)

[SUaDtL]

Closes #536.

The bug

farm.ts carried a literal NUL character inside parts.join(...) — the actual byte, not the \0 escape.

ripgrep treats any file containing one as binary, so every content search across this repo silently skipped its largest source file (~3100 lines) and returned binary file matches instead of results. Hit live while investigating #515: a grep over farm.ts came back empty, and the reason was not the query.

git was unaffected and still is — its binary sniff reads only the first 8000 bytes and the NUL sat at 50941. That is why diffs, blame and review always looked normal and nothing ever flagged it. A search tool that quietly excludes a file is worse than one that errors, because the answer looks complete.

No behaviour change, and no payload change

• farm.js rebuilds byte-identical — the emitted separator is unchanged.
• The payload gate agrees: plugins/ca/tools/ is a build directory and only the declared artifact counts (SBX payload-version gate over-fires on dev-only lockfile changes #435). No ca version bump.
• The crypto reviewer independently executed both forms under Node and confirmed sha256 over a raw-NUL join and an escape join produce the identical digest, so no setup fingerprint is invalidated and no setup cache is busted.

Clearing H-09b

The changed line is createHash("sha256"), so the guard fires correctly even though the change is one character of source spelling. I cleared it through the auth-crypto reviewer rather than around it; the recorded pass binds exactly that one line.

Worth recording: the first attempt was refused. I had moved the checkout out from under the reviewer mid-review, and minting the marker then would have bound the attestation to a different tree. That refusal was correct, and it is the failure mode ADR-0010 exists to prevent.

AC-3 — the durable half

A guard fails if any tracked file with a text extension reintroduces a raw NUL. Scoped to every tracked file rather than a list of trees: a NUL breaks ripgrep wherever it lands, and a five-tree pathspec left 335 tracked files unscanned while the failure message claimed "tracked source files" without qualification.

Both halves are proven by mutation rather than asserted:

control:                                   green
mutant detection-half (raw NUL restored):  KILLED
mutant vacuity-half (pathspec matches nothing): KILLED

The second matters more than it looks. git ls-files exits 0 on a pathspec that matches nothing — measured — so the returncode check alone would have passed vacuously forever. The scanned-count floor is the control that actually does the work.

Confirmation

Verified with the tool that could not read it: ripgrep now returns line-numbered matches from farm.ts.