Revert "fix(config): externalize ws for copilot-m365-web executor (#6098, closes #6062)"

This reverts commit e61b75f007.

scripts/quality/build-test-impact-map.mjs

@@ -60,7 +60,7 @@ function sourceDepsOf(entry) {
 const testFiles = globSync(
   [
     "tests/unit/*.test.ts",
-    "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,executors,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts",
+    "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts",
   ],
   { cwd: ROOT, absolute: true }
 );

scripts/quality/validate-release-green.mjs

@@ -146,7 +146,7 @@ function run(cmd, cmdArgs, opts = {}) {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       maxBuffer: 256 * 1024 * 1024,
-      env: { ...process.env, FORCE_COLOR: "0", ...(opts.env || {}) },
+      env: { ...process.env, FORCE_COLOR: "0" },
       // A hard ceiling for the long, silent test suites (execFileSync buffers all output until
       // exit, so they show no progress while running). undefined = no timeout for fast gates.
       ...(opts.timeout ? { timeout: opts.timeout } : {}),
@@ -255,27 +255,6 @@ function main() {
     });
   }
 
-  // test-masking (hard) — a PR-context gate: it only runs on the release PR (PR→main) in CI, so
-  // net-assert reductions accrue unseen on release/** and explode on the release PR. Reproduce it
-  // here against origin/main so a non-allowlisted reduction surfaces in the pre-flight, not in a
-  // ~40-min CI layer (v3.8.43 cost 3 such round-trips). Legitimate reductions get allowlisted in
-  // config/quality/test-masking-allowlist.json; tautology/skip/deletion signals are never allowlistable.
-  if (!QUICK) {
-    announce("Test-masking (weakened-assert guard vs main)");
-    // best-effort fetch so the merge-base diff is accurate; ignore fetch failure (offline pre-flight)
-    run("git", ["fetch", "--no-tags", "origin", "main", "--depth=200"], { timeout: 60 * 1000 });
-    const { code, out } = run(npmCmd, ["run", "check:test-masking"], {
-      env: { GITHUB_BASE_REF: "main" },
-    });
-    record({
-      id: "test-masking",
-      label: "Test-masking (weakened-assert guard)",
-      kind: "hard",
-      ok: code === 0,
-      detail: code === 0 ? "no weakening" : firstFailureLine(out),
-    });
-  }
-
   // Remaining quality-gate / quality-extended ratchets that the PR→release
   // fast-gates skip and that historically surfaced — one at a time, because the
   // CI Quality Ratchet job is fail-fast — only on the release PR. Running them all