fix: three guards described a build this project does not ship

Two built cmd/tfg without the build tags, which stopped compiling when the
missing tag became a refusal - and one of them reported that as a SKIP
rather than as a failure, which is the silent shape this project has paid
for before. The third matched the literal text of a workflow line and read
an added flag as a job that had disappeared.

Measured while fixing them: the tags do NOT change the dependency set of
cmd/tfg - go list -deps returns the same packages either way, zero lines
differing - so the guards that ask what the binary links were answering
correctly. What the tags change is which files are compiled, which is why
the analysis jobs needed them and these builds do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: donislawdev

internal/guard/licencelist_test.go

@@ -105,7 +105,10 @@ func buildCommandLine(t *testing.T) string {
 	if os.Getenv("GOOS") == "windows" || filepath.Separator == '\\' {
 		binary += ".exe"
 	}
-	build := exec.Command("go", "build", "-trimpath", "-o", binary, "../../cmd/tfg")
+	// With the tags. Without them this build stopped compiling on 2026-09-06,
+	// and the failure arrived as a SKIP rather than as a red guard - which is
+	// the silent shape this project has paid for before.
+	build := exec.Command("go", "build", "-tags", buildTags(), "-trimpath", "-o", binary, "../../cmd/tfg")
 	build.Env = append(os.Environ(), "CGO_ENABLED=0")
 	if out, err := build.CombinedOutput(); err != nil {
 		t.Skipf("building the command line binary is not possible here: %v\n%s", err, out)

internal/guard/sbomgate_test.go

@@ -149,7 +149,10 @@ func TestTheWorkflowScansBothBinariesAndReadsTheReport(t *testing.T) {
 	for _, want := range []string{
 		"-trimpath -o dist/tfg ./cmd/tfg",
 		"-trimpath -o dist/tfg-gui ./cmd/tfg-gui",
-		"go run ./internal/legal/cmd/sbom",
+		// The package rather than the whole line: build tags went in front of it
+		// on 2026-09-06, and a guard reading a literal reports a flag as a missing
+		// job.
+		"./internal/legal/cmd/sbom",
 		"python .github/scripts/sbom_gate.py scan.json ours.spdx.json",
 	} {
 		if !strings.Contains(workflow, want) {

internal/guard/windowsubsystem_test.go

@@ -86,7 +86,10 @@ func TestTheWindowBinaryStartsWithoutAConsole(t *testing.T) {
 
 			built := filepath.Join(t.TempDir(), binary.name)
 
-			args := []string{"build"}
+			// With the tags, because a build without them does not compile at all
+			// since 2026-09-06 - and because the header this reads belongs to the
+			// binary this project ships rather than to some other build of it.
+			args := []string{"build", "-tags", buildTags()}
 			if binary.ldflags != "" {
 				args = append(args, "-ldflags="+binary.ldflags)
 			}