[xiaoheiai4719-collab]

What

Fix repository script entrypoints in checkout paths containing URL-encoded characters.

Why

Seven repository scripts compare import.meta.url with a raw file://${process.argv[1]} string. Node URL-encodes the former but not the latter, so a checkout directory containing a space, %, or # can make the command silently skip its entrypoint and exit successfully without checking or generating anything.

Related work

Related: #5543 decodes URL pathnames in other scripts and tests. This correction instead covers seven entrypoint guards and the SVG generator import; it does not duplicate that PR or close its scope. No separate issue is needed for this self-contained correction.

How

• Compare filesystem paths with fileURLToPath(import.meta.url) in those seven guards.
• Keep the SVG generator's esbuild import as a file URL too, so encoded directory names do not fail during module loading.
• Exercise the real script entrypoints in disposable checkouts with encoded path characters, including invalid-input diagnostics, local generated outputs, and import-only controls.

This does not change validation rules, generated content, package APIs, dependencies, or the Node version requirement. The fixtures never publish, contact GitHub, or write outside their temporary checkout.

Test plan

Updated by merging current main 03ed14615a2988d65ed793f004bcc4446ec89324 into the existing branch. The single adjacent-import conflict retains both fileURLToPath and upstream generatedPaths; the complete upstream implementation and other upstream changes are included, not just the import.

• 233 relevant tests passed, 0 failed, 0 skipped on Linux / Node 24.19.0, including path regressions, comment checks, deletion guard, release-channel validation, generated SVG checks and sanitizer parity.
• The 11 existing generated-output/exemption cases also passed with checker scripts under a path containing spaces, % and #.
• All 7 original encoded-path execution regressions still fail against this exact current main and pass with the fix; import-only controls pass.
• oxlint and oxfmt passed on all 8 PR files. Citation and comment-ratchet diff gates and git diff --check passed.
• The public merge commit has the reviewed complete tree and both intended parents, and GitHub shows its signature as Verified.

Full workspace build/tests, the complete root test:scripts aggregate, browser/render lanes, Windows/macOS and Node 22 were not rerun for this reconciliation. The original patch's Node 22.0.0 run passed the new regressions but had three unchanged TODO-link failures involving URL.parse; that historical result is not a full-green or current-head Node 22 claim. Remote CI still requires its own execution and approval.

AI-assisted implementation, reconciliation and tests: OpenAI Codex. The account owner has not personally rerun these checks.

• Unit tests added/updated
• Manual testing performed (automated CLI regressions only)
• Documentation updated (not applicable: no public interface change)
• Comments follow CONTRIBUTING.md; scoped citation and comment-ratchet gates passed