fix: verify-references installs TS deps; sync-check covers expansion tests; template gitignore and passWithNoTests

verify-references ran a bare `npx vitest run` in the staged reference, which
fetched an unrelated vitest that could not load the reference config. It now
installs the reference's devDependencies first. sync-check also checks each
module's expansion/tests against ### headings in expansion/README.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/verify-references.mjs

@@ -6,11 +6,17 @@ import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { moduleDirs, testFiles, fail } from "./lib.mjs";
 
-const COMMANDS = {
-  rust: () => process.env.VERIFY_CMD_RUST || "cargo test",
-  ts: () => process.env.VERIFY_CMD_TS || "npx vitest run",
+// A staged reference has no node_modules, so TS installs the reference's own
+// pinned devDependencies first (a bare `npx vitest` would fetch an unrelated version).
+const DEFAULTS = {
+  rust: "cargo test",
+  ts: "npm install --no-audit --no-fund --loglevel=error && npx vitest run",
 };
 
+export function commandFor(lang, env = process.env) {
+  return env[`VERIFY_CMD_${lang.toUpperCase()}`] || DEFAULTS[lang];
+}
+
 export function planVerification(mods, upTo) {
   return mods
     .filter((m) => Number(m.num) >= 1 && Number(m.num) <= upTo)
@@ -41,7 +47,7 @@ if (import.meta.main) {
   for (const p of plans) {
     for (const lang of p.langs) {
       const dir = stage(p, lang);
-      const r = spawnSync(COMMANDS[lang](), { cwd: dir, shell: true, encoding: "utf8" });
+      const r = spawnSync(commandFor(lang), { cwd: dir, shell: true, encoding: "utf8" });
       const ok = r.status === 0;
       failed ||= !ok;
       console.log(`module ${p.num}-${p.slug} [${lang}]: ${ok ? "ok" : "FAIL"}`);