fix(aihr): prevent strict gate bypass

scripts/demo-check.sh

@@ -325,6 +325,7 @@ check_pilot_samples() {
 }
 
 if [[ "${AIHR_DEMO_CHECK_LIBRARY_ONLY:-false}" == "true" ]]; then
+  [[ "${AIHR_PILOT_STRICT:-false}" != "true" ]] || fail "AIHR_DEMO_CHECK_LIBRARY_ONLY cannot bypass strict pilot checks"
   return 0 2>/dev/null || exit 0
 fi
 

scripts/tests/demo-check-pilot-gates.test.sh

@@ -32,6 +32,15 @@ assert_contains 'reviewed_time >='
 assert_not_contains 'p.identity_key = o.ext_party_id OR p.identity_key = o.person_phone'
 assert_not_contains 's.ext_party_id = o.ext_party_id OR s.ext_party_id = o.person_phone'
 
+if (AIHR_DEMO_CHECK_LIBRARY_ONLY=true AIHR_PILOT_STRICT=true "$SCRIPT") >/tmp/wygj-pilot-library-strict.log 2>&1; then
+  echo "FAIL: library-only mode bypassed strict pilot checks" >&2
+  exit 1
+fi
+grep -Fq 'AIHR_DEMO_CHECK_LIBRARY_ONLY cannot bypass strict pilot checks' /tmp/wygj-pilot-library-strict.log || {
+  echo "FAIL: library-only strict guard is unclear" >&2
+  exit 1
+}
+
 if ! command -v docker >/dev/null || ! docker ps --format '{{.Names}}' | grep -qx 'wygj-mysql'; then
   echo "SKIP: behavioral pilot gate test requires wygj-mysql"
   exit 0