test: cover the data/awards.json render contract (tests/awards-data.test.mjs)

[kubestellar-hive]

Test Improvement

Adds one new test-only file, tests/awards-data.test.mjs (11 tests), asserting
the real data/awards.json against the render contract that
src/components/AwardsTimeline/index.js depends on.

Files claimed by this PR: tests/awards-data.test.mjs (new). Nothing else —
no production code, no workflow, no package.json, no lockfile, no dependency.
It uses only node:test, node:assert/strict, node:fs, node:path and
node:url.

The gap

scripts/validate-awards.mjs is tolerant exactly where AwardsTimeline is not,
so an awards file that passes npm run validate:awards can still render a wrong
or misleading /awards page:

• the validator accepts any https:// URL for verifiedAgainst, but the
  component hard-codes the visible link text
  contribute.cncf.io/community/awards — href and label can drift apart and the
  page then misattributes its own audit source
• the validator only calls Date.parse(verifiedAt); a future date passes and the
  banner claims an audit that has not happened
• the validator checks !entry[field], so citation: 5 and event: " " pass
  and render as 5 and a blank line
• /^https:\/\// accepts the bare string https://, which new URL() rejects
  and no browser can resolve
• nothing dedupes entries, and the React key is ${slug}-${index}, so a
  duplicated winner renders twice silently
• award is a machine slug and awardLabel its display string; two labels for
  one slug read as two different awards

Verification

Local clone of cncf/endusers at 00b44df, node v26.8.2, 2026-09-20.

• node --test: 66 pass, 0 fail (55 before; the 11 new tests are all that
  changed).
• npx prettier --check tests/awards-data.test.mjs: clean.
• npm run validate:awards on restored data: passes.

Mutation check. Nine single-field mutations applied to data/awards.json,
one at a time, each restored afterwards. Eight pass the validator and are caught
here:

mutation	validate:awards	tests/awards-data.test.mjs
verifiedAgainst repointed to another host	PASS	FAIL
verifiedAt set to a future date	PASS	FAIL
citation set to a number	PASS	FAIL
event set to " "	PASS	FAIL
slug set to Acme_Corp	PASS	FAIL
duplicate winner entry inserted	PASS	FAIL
announcementUrl set to https://	PASS	FAIL
two awardLabels for one award slug	PASS	FAIL
out-of-range year (1999)	FAIL	FAIL

data/awards.json is byte-identical to main after the run (git diff clean).

Disjointness

No open PR names AwardsTimeline or reads data/awards.json top-level fields.
#253 (tests/members-data.test.mjs) touches awards.json only for
members.json ↔ award slug parity; it asserts nothing about verifiedAt,
verifiedAgainst, ordering, duplicates, URL resolvability or label consistency,
and reads no component. #329 claims award logo path resolution, which this
PR deliberately leaves alone. #287 is the same species of contract for
metrics.json ↔ MetricsDashboard; #260 covers catalog ↔ records ↔ docs; #229
covers filterArchitectures; #268 covers useFocusTrap.

There is no JSX transform under node --test (#228), so the component cannot be
imported; the two cross-file assertions read the component source and are
written to fail loudly — rather than vacuously pass — if the source stops
matching.

Related Issue

Closes #359

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.