Summary

The collection metadata validation (npm run lint:collections-metadata) checks that paths in collection YAML files point to files that exist, but does not enforce that the intermediate folder name matches the collection ID. This allowed .github/agents/code-review/ to persist under the coding-standards collection without detection.

Context

Discovered during the folder rename tracked in #1208. The code-review folder survived under coding-standards from PR #863 (collection merge) until PR #1174 review exposed it. A path-prefix check would have caught this drift at CI time.

Expected Behavior

When a collection YAML item has kind: agent and path .github/agents/{folder}/file.agent.md, validation should verify that {folder} matches the collection ID or is an explicitly allowed exception (e.g., shared).

Update: since there are some collections / folders with cross-collection bundling (security & project-planning inter-reference each other): we want to allow this for the current implementation.
What we need to warn is a new item in a folder, for which no collection ID exists (no manifest, no md file). The item may additionally be added to another collection, but must at least exist in its own collection that matches the folder name.

The same check applies to all four artifact kinds:

Acceptance Criteria

• Validate-CollectionMetadata (or equivalent) checks that the first path segment after the kind prefix matches either the collection ID, shared or another collection ID
• Specifically warn on artifacts which have been added into a folder but are not present in their matching folder (udate: newly added criterion)
• The hve-core-all collection is exempt (it intentionally bundles items from all collections)
• npm run lint:collections-metadata catches the violation when tested against the pre-fix state
• Existing collections pass validation after Rename code-review folders to coding-standards to match collection-to-folder convention #1208 is resolved