check-drive-root-litter.sh misses known temp-sink residue (C:\tmp): single-letter-only matcher

[kyle-sexton]

Problem

scripts/check-drive-root-litter.sh is the post-hoc detection net for drive-root residue left by a POSIX path handed to a Windows-native consumer. Its only detection class was a drive-root directory whose name is a SINGLE LETTER that is itself a mounted drive (the /d/... -> C:\d\ fingerprint).

That class cannot see the sibling fingerprint of the same mechanism spelled /tmp: on 2026-08-30 an empty C:\tmp\tmp.rSFIkHm5DO (an mktemp-template name) was observed at a drive root on a dev machine, and the detector scored the host clean — tmp is not a single letter, so no rule matched.

Expected

A known temp-sink name at a drive root (C:\tmp) is the residue of exactly the defect class this detector owns and should be reported, with the same false-positive protections the single-letter class has (cwd-containment) and a path for an operator who keeps a deliberate C:\tmp.

The sink-name vocabulary should be reused from the sibling guard plugins/guardrails/hooks/block-windows-drive-tmp.sh (which blocks the same sink at command time) rather than invented.

Scope notes

• The single-letter class and its mounted-drive precision rationale must stay intact.
• The detector stays advisory per ADR 0003 (no measured precision, no required gate).
• Non-Windows no-op ordering and the 0/1/2 exit-code contract are unchanged.