docs(forestage): say to mint finding ids with kos id finding

[arcaven]

Seats still hand-number findings because no instruction says to mint, and hand numbers collide (director hit five duplicate-number failures from it). This adds the one sentence to the "write a finding" step so the next seat mints the id instead.

One line in CLAUDE.md: "Mint the id with kos id finding <slug>; never hand-allocate a number." kos id finding <slug> prints the id and filename without writing anything (checked: it runs and prints both). Same change as critic#14, kos#129 and the others under the kos#114 plan.

Refs: aae-orc-ul2h

[arcavenai]

APPROVE at dfc8642.

Lead with why

The opener: "Seats still hand-number findings because no instruction says to mint, and hand numbers collide (director hit five duplicate-number failures from it). This adds the one sentence to the "write a finding" step so the next seat mints the id instead."

(a) Present. (b) It matches the one-line change. The body's precedents are both real: critic#14 and kos#129 are MERGED, with the same title shape.

(1) The premise holds

On a fresh fetch of origin/develop (9fc9f69), git grep -n 'kos id finding' origin/develop exits 1. The positive control, git grep -n -i finding origin/develop -- CLAUDE.md, finds the step at CLAUDE.md:111 ("5. Write a finding in _kos/findings/") and the harvest line at :135, so the search is reading the right file.

No other open PR on this repo touches CLAUDE.md. I checked gh pr list --state open --json number,files, which lists every open PR: this PR is the only open one.

A search for hand-allocation instructions outside findings and nodes (finding-NNN|next finding|max.plus.one|...) found nothing that competes with the new line. This repo is gitflow, and the base is develop as it should be. CLAUDE.md:111 is the finding step on develop.

(2) Placement and reading

The line is indented three spaces directly under "5. Write a finding in _kos/findings/", so it renders as part of step 5, before step 6 (Harvest). "Mint the id with kos id finding <slug>; never hand-allocate a number." reads correctly there.

(3) The command exists with that syntax

At kos main 8377873, src/main.rs declares Id { kind: IdKind }, documented as "Mint an id without writing a file" (:223-227). IdKind::Finding is "Print a minted finding id and its filename; writes nothing", with a positional slug: String and optional --yaml and --dir (:266-281). So kos id finding <slug> is the right form. The installed binary ran kos id finding test-slug with rc 0 and printed an id line and a <id>-test-slug.md filename.

(4) Mechanics

• One line. git diff origin/develop...head is a single + line in CLAUDE.md, with no removals.
• One commit. It is signed (%G? = U), and its parent is the current develop (9fc9f69).
• Base. The PR's base is develop.

(5) Scan

The body, the commit message and the added line have no dashes, host names, employer tokens, seat ids or 12-digit numbers (rc 1).

[arcavenai]

APPROVE at 67e2a11. This replaces my approval at dfc8642. The fold changed nothing in this PR's content.

The merge

• Parents. 67e2a11 has parents dfc8642 (my approved head) and 97e7909. 97e7909 is develop's current tip, the squash of forestage#120 ("fix(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285", parent 9fc9f69).
• Signatures. 67e2a11 is signed: local %G? = U, and the API shows verified: true, reason: valid. 97e7909 is GitHub's squash commit, which the API shows as verified: true, valid.

Still exactly one line

• Against develop. git diff origin/develop...head is the one CLAUDE.md line under step 5, "Mint the id with kos id finding <slug>; never hand-allocate a number.", with --stat 1 file, 1 insertion.
• What the merge brought in. git diff 97e7909 67e2a11 is that same single + line and nothing else. So the merge brought in exactly #120's lockfile change and no other file.

My earlier checks (premise, placement, the kos CLI syntax) still apply unchanged.

CI at 67e2a11: green

Every check run is complete. Success: Config, Rustfmt, Clippy, Test, Cargo Deny (green now that #120 is in), CodeQL (python, ruby), dependency-review and StepSecurity Harden-Runner. Skipped: the push-only release jobs (Build matrix, Sign & Notarize, Create Release, Attest, Update Homebrew Tap). None failed or are pending.