Suggested preventive CI check from @koala73 in #3242 second-pass review. Would have mechanically caught HIGH(new) #1 (SupplyChainServiceClient using globalThis.fetch).

Goal: mirror scripts/enforce-rate-limit-policies.mjs pattern — walk src/services/**/*.ts, find every new *ServiceClient(...) call, and assert that if the client's generated methods target any path in PREMIUM_RPC_PATHS, the fetch option is premiumFetch.

Why this matters: HIGH(new) #1 from #3242 was exactly this class — SupplyChainServiceClient was constructed with globalThis.fetch, so signed-in browser pros got silent 401s that the generated client's try/catch swallowed into empty responses. Prior PR #3233 fixed the same class for RegionalIntelligenceBoard / DeductionPanel / trade / country-intel.

Implementation sketch:

1. Parse each *ServiceClient construction site via AST (ts-morph or a regex that asserts { fetch: premiumFetch } when paired with any of the client's known premium-path methods).
2. Cross-reference against PREMIUM_RPC_PATHS + generated method→path mappings (derivable from the generated service_client.ts files).
3. Fail pre-push and CI if any client targets a premium path without premiumFetch.

Scope: new tooling, warrants its own review attention. Wire into pre-push + CI after the lint passes clean against current main.

Context: flagged in #3242 review — deferred from that PR to keep scope bounded.