Let the seed-file guard skip where config/ does not exist

[fgurbanov]

Fixes the red deploy-ds1 on main (run 31160910710).

What broke

The ADR-0021 guard added in #103 scans config/ to prove no seed file reintroduces a secret: ${VAR}. But config/ lives outside service/, and the production image is built with service/ as its entire context while running npm test in the Dockerfile. So inside that build the seed files genuinely do not exist and the image build died on:

Error: ENOENT: no such file or directory, scandir '/config/'
failed to solve: process "/bin/sh -c npm run build && npm test && npm prune --production" did not complete successfully: exit code: 1

DoD was fully green on #103 because it runs against a complete repo checkout — the two environments differ exactly where this test reads.

The fix

tests/deploy-env-passthrough.ts already hit this same seam and solved it, so this borrows its hasRepoTree idiom: skipped inside the image, enforced in the DoD job where the files exist and the check is meaningful. Nothing in an image can attest to seed files it was never given.

The readdirSync also moves to module scope. describe.skipIf still evaluates the factory in order to register its tests, so a scandir inside the body throws during collection and fails the file before the skip can apply — my first pass at this fix kept the read inside the describe and still broke the build. Worth knowing for the next test that reaches outside service/.

Verification

Built service/Dockerfile locally, the same way the deploy does:

• in-image: Test Files 16 passed | 1 skipped, Tests 210 passed | 7 skipped, docker build exit=0
• full tree: Test Files 17 passed, Tests 229 passed — the guard still runs and still enforces

🤖 Generated with Claude Code