fix: close nine contracts that could only check what they were told

[rldyourmnd]

What this is

Nine main-line defects found by auditing main against its own contracts. Every
one was invisible to a fully green gate — validate_all all tiers, actionlint,
and zizmor at both personas all passed before this branch.

The theme is the same in most of them: a contract that could only ever check
what someone remembered to tell it.

The defects

	Was	Now
.claude/CLAUDE.md	Claude Code's only auto-loaded file told every agent to run a command that aborts with ModuleNotFoundError after #144	corrected, registered, and discoverable
execution contract	read prose only from a closed 15-entry allowlist, so an unlisted document was never opened	discovers every document that launches a real scripts/ subject; unlisted or stale-exempt fails
capability.schema.yaml	never executed — the validator only checked the file existed, so the schema forbade runtime_requirements (which two capabilities use) while seven last_verified values had drifted to datetime.date	executed against the catalog by a dependency-free validator; duplicated Python enums removed
check_rulesets.py	enforcement checked against an enum that accepts disabled; tag validation was one boolean	branch/tag rulesets must be active; the tag-immutability rule set and the bypass-actor set are pinned
zizmor guidance	four documented invocations, three wrong: regular where CI runs pedantic, an unpinned binary, and no GH_TOKEN in either CONTRIBUTING.md command	all five identical, derived from the workflow inputs and from what ci.yml passes
secret-scan.yml container lane	the default mode validated nothing — the guard returned before it looked and gitleaks_image was not in the step env — while printing "digest-pinned caller contract"	requires an @sha256: digest; six executable cases
secret-scan.yml scope	scanned every ref a fetch-depth: 0 checkout brings in, so an unmerged branch failed the scan on every other branch	scoped to the checked-out ref; all-refs must be asked for
CHANGELOG.md	## [0.11.0] described a release that was never tagged; two headings predated their own tags	reconciled; structure blocks in core, tag reconciliation is advisory
inventory counts	46/nine/twenty-seven/nine against a tree of 47/10/35/10, plus a duplicated sentence and README claiming tags are mutable	volatile counts removed rather than corrected; README matches the adoption skill

Evidence

Every new rule is proven to reject, not just to pass:

• discovery: a planted unregistered document fails; a foreign-tool document passes
• schema: rejects an unquoted date, an unexpected property, a bad enum, an empty sources
• rulesets: rejects a disabled branch ruleset, a removed update rule, an added bypass actor, a stale exemption
• documented commands: rejects a reverted persona and a workflow pin bumped without the docs
• release ledger: rejects a date contradicting its tag, bad ordering, a duplicate heading, a missing date, an untagged heading, a VERSION with no heading
• secret-scan: rejects tag-only / latest / empty / short / uppercase-digest images and unknown scopes

Runtime: secret-scan.yml re-proved on run 31750480571 — both Linux X64 lanes green, proven_digest aa65f5d9.

The scope defect was found by running it: the first attempt on this branch went
red on a finding in a commit that is an ancestor of neither this branch nor
main. That failure is recorded in the ledger evidence rather than hidden.

Permissions and threat model

No permission changes. Two trust boundaries tighten:

• secret-scan.yml no longer passes an unvalidated caller string to docker run
  in a workflow that reads every secret in the tree.
• The scan result no longer depends on refs the change does not touch, which is
  what a required check is supposed to guarantee.

scan_scope is a behaviour change: a consumer relying on the implicit
all-branch sweep must now pass scan_scope: all-refs. Recorded in the changelog.

Out of scope, filed instead

• .gds/repository.yaml's stale verification command and the 49-commit-behind
  submodule pointer → NDDev-it-com/github-device-sync#176 (control-plane owned)
• PR chore: checkpoint #129 SDK runtime evidence WIP #145 / issue Build bounded SDK runtime fixtures for Flutter, Android, and Qt #129 findings → filed separately; not touched here