fix(summary): identify CSV financial year

[lamemustafa]

Summary

Add financial_year as the first column of the unreleased full-year summary CSV and repeat the selected scope in every row.

Root Cause / Decision Record

• A fixed-name CSV previously identified period, return type, artifact, outcome, and flattened field, but not its selected financial year.
• A first financial_year column keeps the human-readable year/period pair together and preserves scope if a row is extracted or recombined.
• The value is derived from the already-required one-year plan before row construction, then passes through the existing CSV serializer. The transient identity context contract remains unchanged because it is not an emitted CSV artifact.
• Closes Deferred review findings from the overnight run #178 finding 2 only. Findings 1, 3, and 4 are explicitly out of scope.

Scope

• Runtime: add one validated scope column to full-year summary CSV data rows.
• Tests: exact emitted CSV text, ZIP-level rows, and mixed-year refusal.
• Docs/governance: update README and Privacy QA artifact schema descriptions.
• Explicitly out of scope: manifest, permissions, persistence, redaction-module refactors, and all other Deferred review findings from the overnight run #178 findings.

Pack Workflow Preflight

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• This PR does not consume @sanchika/* packages or copied Sanchika guidance.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent source paths.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are updated for the emitted schema change.

Sensitive Surface Review

• Current tab / portal target binding is preserved.
• Download completion remains evidence-backed and fail-closed.
• Ambiguous side-effect delivery cannot be reported as confirmed success.
• Service-worker durability impact is unchanged.
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year ships in the one binary but stays out of Store-advertised scope until its evidence gates are recorded.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed for the schema change.
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec vitest run
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip (release-only)
• node scripts/verify-extension-zip.mjs (release-only)
• node scripts/write-release-provenance.mjs (release-only)
• node scripts/verify-github-release-assets.mjs --tag <tag> --zip <zip> --checksum <sha256> --provenance <json> (release assets absent)
• node scripts/publish-chrome-web-store.mjs --zip .output/<zip> --provenance .output/pack-release-provenance.v1.json --publisher-id <id> --dry-run true (release-only)
• git diff --check
• pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 --allow-missing-head-review before merge/readiness claim; this draft is not merge-ready.

Artifact Evidence

• CI run: pending
• ZIP artifact: not produced; release-only
• ZIP SHA-256: not applicable
• Clean source/tag or head SHA: 682c68f

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA.
• No inline review threads exist on this new draft at creation.
• No commits were pushed after the latest required review because no review exists yet.
• No follow-up PRs or issues are required for this scoped change.
  Linked follow-up: FILED_RETURNS_SUMMARY_CONTEXT_HEADERS is exported and read by nothing #215 documents the unreferenced transient context-header export; it is out of scope for this PR.

Thread/comment	Disposition	Commit or evidence
#178 finding 2	fixed	6534830, a136c27, emitted CSV and ZIP assertions
#215 context-header export	follow-up	linked #215; no change in this PR

Screenshots

Not applicable: generated CSV schema change, covered by synthetic text assertions.

DCO

• Commits include Signed-off-by: trailers.

[lamemustafa]

Recording the audit gap for the merged head, per docs/AGENT_REVIEW_RECTIFY.md.

This PR merged with no automated review at all — not merely none at the merged head. Querying reviews by chatgpt-codex-connector across every head of #214 returns none. The three preceding PRs each drew at least one round (#212 one, #213 three, #210 five), and every one of those rounds found something real. This one drew nothing, so the change carries no independent scrutiny beyond mine.

Verified on merged master dbcd0cb, in a clean worktree: Tests 2079 passed (2079), Test Files 124 passed (124), plus tsc, eslint, prettier, wxt build and verify-extension-package. The count reconciles exactly against the named clean-master baseline of 2077/124 at 01e3582, +2 for the two tests added here.

What I checked independently rather than accepting from the implementation report, since that is the only review this change received:

• Both red proofs reproduce. Dropping financial_year: row.financialYear fails emits the single planned financial year in every CSV row and nothing else; disabling the single-year rejection fails refuses a mixed-year plan before it can form a CSV and nothing else. Mutation verified applied in both cases, 120 neighbours passing, which distinguishes a real guard from a broken module.
• The decision to leave FILED_RETURNS_SUMMARY_CONTEXT_HEADERS alone is correct: context rows feed the workbook identity header block via filed-returns-full-year-workbook.ts:72,96 and are never serialised as CSV. That constant turned out to be referenced exactly once in the repository — its own declaration — now tracked as FILED_RETURNS_SUMMARY_CONTEXT_HEADERS is exported and read by nothing #215.
• The single-year rule was extracted, not duplicated. It previously lived inside buildContextRows, where it validated and discarded the value; it is now summaryFinancialYear, called once at the top of buildFiledReturnsSummarySheet and used. buildContextRows has exactly one caller, in the same function body, after the new call — so the guard is preserved and runs earlier. Turning a validate-and-discard into a derive-the-canonical-value is the change I would most want a second reader on, and did not get one.

Not covered. No live authenticated run produced a real full-year-summary.csv with the new column. The schema change is narrow and #178 did not ask for one, but nothing here proves the emitted artifact on real portal data — only on fixtures.