fix(schema): drop retired Hint dead code and harden CI coverage shards

Remove manual_hints/Hint* leftovers after declare-or-annotate delivery, and fix macOS auth scoping plus Windows/.exe TestMain and race shard packaging so platform coverage gates stay reliable.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/generator/cmd_schema_agent_metadata/main.go

@@ -33,7 +33,7 @@ var (
 	validateMetadataAllowlist      = validateAgentMetadataOutputAllowlist
 	validateMetadataRegistryFile   = validateCommandRegistryFile
 	loadMetadataRegistryProjection = loadEffectiveCommandRegistryProjection
-	validateMetadataSelection      = validateSelectionHintInput
+	validateMetadataSelection      = validateSelectionCoverage
 	generateAgentMetadata          = agentmetadata.Generate
 	writeMetadataDirectoryOutput   = writeMetadataDirectory
 	writeMetadataFileOutput        = writeMetadataFile
@@ -168,7 +168,7 @@ func main() {
 	}
 	_, _ = fmt.Fprintf(
 		os.Stderr,
-		"generated schema Agent metadata: output=%s sources=%d products=%d tools=%d summaries=%d interface_summaries=%d intents=%d examples=%d risk_rules=%d hint_files=%d hint_tools=%d unmatched=%d surface_tools=%d\n",
+		"generated schema Agent metadata: output=%s sources=%d products=%d tools=%d summaries=%d interface_summaries=%d intents=%d examples=%d risk_rules=%d unmatched=%d surface_tools=%d\n",
 		delivery,
 		stats.SourceFiles,
 		stats.Products,
@@ -178,8 +178,6 @@ func main() {
 		stats.ToolIntents,
 		stats.Examples,
 		stats.RiskRules,
-		stats.HintFiles,
-		stats.HintTools,
 		stats.UnmatchedTools,
 		registry.ToolCount,
 	)
@@ -408,8 +406,8 @@ func mergeRegistryShards(dir string) ([]byte, error) {
 	return json.Marshal(result)
 }
 
-func validateSelectionHintInput(rootPath, hintsDir string, registry commandRegistryProjection) error {
-	return agentmetadata.ValidateSelectionHints(rootPath, hintsDir, registry)
+func validateSelectionCoverage(_ string, _ string, registry commandRegistryProjection) error {
+	return agentmetadata.ValidateSelectionCoverage(registry)
 }
 
 func resolveRootPath(root, path string) string {
@@ -420,15 +418,6 @@ func resolveRootPath(root, path string) string {
 	return filepath.Join(root, path)
 }
 
-// validateManualHintsOutputIsolation protects reviewed human-authored hint
-// inputs before the generator writes any output.
-func validateManualHintsOutputIsolation(rootPath, hintsDir, outputPath, outputDir, auditOutputPath string) error {
-	return validateAgentMetadataOutputIsolation(rootPath,
-		[]outputguard.Input{{Name: "structured hint input directory", Path: hintsDir}},
-		outputPath, outputDir, auditOutputPath,
-	)
-}
-
 func validateAgentMetadataOutputIsolation(rootPath string, inputs []outputguard.Input, outputPath, outputDir, auditOutputPath string) error {
 	return outputguard.Validate(rootPath,
 		inputs,