fix: harden demo lifecycle and scanner

tools/scan-project.sh

@@ -13,7 +13,9 @@ filler_pattern='lorem[[:space:]]+ip''sum|fill''er[[:space:]]+text'
 unsafe_pattern='unsafe''Allow|unsafe''SkipStorageCheck|unsafe''SkipAllChecks|oz-upgrades-unsafe-allow'
 allowed_annotation='    /// @custom:oz-upgrades-unsafe-allow constructor'
 fixture_name='ANVIL_''TEST_PHRASE'
-fixture_value='test test test test test test test test test test test junk'
+allowed_fixture_path='script/lib/DemoScript.sol'
+allowed_fixture_line='    string internal constant ANVIL_''TEST_PHRASE = "test test test test test test test test test test test junk";'
+fixture_count=0
 violations=0
 
 report_matches() {
@@ -34,9 +36,13 @@ for path in "${TRACKED[@]}"; do
   report_matches "$path" "$unfinished_pattern" 'unfinished marker'
   report_matches "$path" "$filler_pattern" 'filler content'
   while IFS= read -r line || [[ -n "$line" ]]; do
-    if [[ "$line" == *"$fixture_name"*'='* && "$line" != *"$fixture_value"* ]]; then
-      printf 'forbidden non-fixture local phrase assignment: %s:%s\n' "$path" "$line" >&2
-      violations=$((violations + 1))
+    if [[ "$line" == *"$fixture_name"*'='* ]]; then
+      if [[ "$path" == "$allowed_fixture_path" && "$line" == "$allowed_fixture_line" ]]; then
+        fixture_count=$((fixture_count + 1))
+      else
+        printf 'forbidden local phrase assignment outside exact fixture: %s:%s\n' "$path" "$line" >&2
+        violations=$((violations + 1))
+      fi
     fi
   done <"$path"
   if [[ "$path" == src/* || "$path" == test/* || "$path" == script/* ]]; then
@@ -49,5 +55,10 @@ for path in "${TRACKED[@]}"; do
   fi
 done
 
+if ((fixture_count != 1)); then
+  printf 'expected exactly one local phrase fixture assignment, found %d\n' "$fixture_count" >&2
+  violations=$((violations + 1))
+fi
+
 ((violations == 0)) || { printf 'Project scan failed with %d violation(s).\n' "$violations" >&2; exit 1; }
 printf 'Project scan passed across %d tracked paths.\n' "${#TRACKED[@]}"