fix: verify-references installs TS deps; sync-check covers expansion tests; template gitignore and passWithNoTests

verify-references ran a bare `npx vitest run` in the staged reference, which
fetched an unrelated vitest that could not load the reference config. It now
installs the reference's devDependencies first. sync-check also checks each
module's expansion/tests against ### headings in expansion/README.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/test/sync-check.test.mjs

@@ -14,3 +14,9 @@ test("sync_passes_consistent_course", () => {
   const r = run("sync-check.mjs", [], { COURSE_ROOT: join(fixtures, "course") });
   assert.equal(r.code, 0, r.out);
 });
+
+test("sync_checks_expansion_tests_against_readme", () => {
+  const r = run("sync-check.mjs", [], { COURSE_ROOT: join(fixtures, "course-bad") });
+  assert.match(r.out, /01-a expansion: test_01x_c missing from ts/);
+  assert.match(r.out, /01-a expansion: test_01x_c missing from scenarios/);
+});