feat(repo): publish CLAUDE.md, the backlog and the worktree guide; restore the backlog gate

[wshallwshall]

The cutover put these in a gitignore private-only block. Three of them didn't need to be there, and keeping them out cost more than it protected.

Why CLAUDE.md is the important one

git worktree add cannot deliver an untracked file. Verified on both live worktrees before this change:

MessageFoundry-flake-monitor-spin:     MISSING  CLAUDE.md
mefor-jdbc-support-c275bd:             MISSING  CLAUDE.md

So every worktree came up with zero project conventions loaded — no HL7 parsing rules, no PHI rules, no architecture constraints. Silently. It only appeared to work in the primary checkout because an untracked copy happens to sit on disk there. Tracking it fixes that permanently and versions it for the first time since the cutover.

The backlog gate was stranded, not dead

backlog-hygiene.yml was never published — not gitignored, just never shipped — so the banner/number-reuse gate ran only on the private vault, which no longer receives the work. And tests/test_backlog_status_check.py was skipping permanently on a reason string describing the retired mirror topology.

Both now run: 229 backlog items validated, 15 previously-skipped assertions live.

Redactions (2 sites)

• L592–593 enumerated the real estate/vendor tokens and the site-code pattern — i.e. the leak gate's own protected list. Replaced with a pointer to the private token file.
• L6837 carried a phrase a [names] detector flags as a migration artifact. Rephrased to the hyphenated form the same document already uses in item #105; meaning unchanged.

How this was verified

The leak gate was run with the real token set, reconstructed from the retired scripts/publish/scan_forbidden.py in the vault. It reports:

loaded names=7, estate=13, estate_file_scanned=12, site_prefixes=1

— identical to the counts CI logs using its own secret — and exits 0 with no findings. So this was checked by the project's authoritative gate, not an approximation of it.

Worth stating plainly: the token-value scan I ran first missed the second redaction. The real gate caught it. That's the whole argument for not trusting a partial scan before an irreversible publish.

Ledger gate fix, forced by the import

The gate crashed on git show origin/main:docs/BACKLOG.md (exit 128) — the base has no version of a file being added. Treating that as an empty ledger would be worse than the crash: every heading then reads as a brand-new number and the gate reports ~229 items as "not allocated to this worktree".

Absence is now probed explicitly (base_has) rather than inferred from an error, so git() keeps raising on real failures — the property that stops a swallowed error reading as "no numbers taken".

Two tests added. The first is mutation-verified (neutralise the guard, it fails). The second pins a system-level property only, and its docstring says so — removing base_has's own rev-parse guard leaves it green, so claiming otherwise would be false assurance.

Still private, each for its own reason

Path	Reason
docs/security/ (32 files), docs/reviews/	Posture and findings detail — an attacker roadmap.
docs/CI-TOPOLOGY.md	Stale. Documents the private/mirror split and scripts/publish/, which the cutover deleted. Publishing it would actively mislead. Needs a rewrite or deletion.
docs/Secure_Development_Standards.md	Scans clean, but was deliberately pulled from the public PyPI sdist (#1020). Reversing that is an owner decision, not a side effect.

🤖 Generated with Claude Code