[quality] scripts/check-oci-refs.py has 0% unit test coverage

## Finding `scripts/check-oci-refs.py` (88 statements) has zero unit test coverage. This script is critical infrastructure that: 1. **Enforces the org migration** from `ghcr.io/ublue-os/` to `ghcr.io/projectbluefin/` 2. **Validates OCI image:tag references** in docs against GHCR to prevent broken documentation Without tests, regressions in either check could silently allow invalid image references to ship in documentation or re-introduce ublue-os references. ## Current State - The existing `tests/test_hooks.py` and `tests/test_bazaar_hook.py` cover the hooks module (20 tests passing) - `scripts/check-oci-refs.py` has **no corresponding test file** ## Recommendation Add `tests/test_check_oci_refs.py` with subprocess-based tests covering: - Check 1: ublue-os migration enforcement (allowed upstreams, exceptions, skip dirs) - Check 2: image:tag validation (regex parsing, sha256 skipping, GHCR resolution) A ready-to-use test file with 13 passing tests has been prepared and validated locally. ## Priority - Impact: **high** — guards release integrity and org migration - Effort: **low** — test file is ready, just needs push access --- *Filed by quality agent (hold-gated mode)* <!-- factory-pipeline-start --> **Common · issue pipeline** ```text ▶ triage needs kind/ + area/ then /approve · discussing — · queued — · claimed — · done — ``` **area:** — &nbsp; **priority:** — **maintainer:** set kind/ + area/ labels, then comment /approve **reporter:** answer questions; add repro steps if a bug <!-- factory-pipeline-end -->