docs(services): correct the stale out-of-scope service declarations - #104

The scan's `[test]` pin in test-spec.md asks for a step in the lint job, and
that edits .github/workflows/test.yml -- CI configuration, a hard-disqualifier
zone this task's REQs do not mandate touching. The zone screen fires, so the
step is backed out of the branch and recorded in tasks.md Awaiting input with
the exact YAML to apply, rather than landing unattended.

The script itself is unchanged and still green; only where it runs from is
open.

Planwright-Task: dev-services/5

Surfaced by Task 5's wider-suite run: the machine-local identifier file now
exists, but .gitleaks.toml was never regenerated from it, so the committed
block and a fresh generation differ. Outside this unit's scope; recorded as
seed material rather than acted on.

Planwright-Task: dev-services/5

Review pass over this branch's own additions:

- CLAUDE.md said the role applies "the colima steps" on Darwin; every one of
  them is further gated on inventory_hostname == 'personal', so only the
  my.cnf symlink applies on work and alt.
- CLAUDE.md read "the exception among those" after the enumeration it refers
  to stopped containing services. It is an exception to them, not among them.
- The databases-and-caches omission bullet named no cache, so a reader
  grepping the block for valkey-server got no hit for exactly the kind of
  absence the block exists to explain. redis-tools now says which half of the
  pair it is, since the client sits in this list and the server does not.
- tasks.md attributed Task 2's CI matrix entry to REQ-E1.4. That REQ is the
  constraint on the workflow edit; Task 2's own Deliverables are what called
  for it.

Planwright-Task: dev-services/5

…nd spots

Review pass over the harness this branch added. It was green, and several of
its assertions could have stayed green while the thing they name was wrong.

- No positive control: nothing proved the scanner could still detect a stale
  claim, so any regex or windowing edit would have left it reporting clean
  forever. It now runs against a five-file fixture on every run, covering a
  plain claim, a reflowed one, a negated one, and two shapes that must not be
  flagged. Reworking the pairing rule below broke that fixture twice before it
  passed, which is the point of having it.
- Line-distance pairing replaced by statement units (a blank-line block, split
  at list markers). A window was wrong in both directions: narrow, a bullet
  reflowed to another column becomes a silent miss; wide, an out-of-scope
  sentence in a neighbouring paragraph pairs with a service name. Verified
  against the pre-fix content: exactly the three stale spots, and not the
  Containers bullet sharing their comment block.
- Negated claims are no longer flagged, so "databases are no longer out of
  scope" is writable. The old rule pushed documentation away from naming the
  history it corrects.
- The claim vocabulary covers "not in scope" and "outside the scope"; the
  subject vocabulary is derived from the declaration rather than snapshotted,
  so a service declared later brings its own terms, the way the sibling
  harness does it.
- services-role-described no longer satisfies its own precondition: it
  resolves the declaration path the guide names and asserts the file exists,
  which catches both a guide left behind by a move and a guide correctly
  updated after one.
- services-not-cross-platform-config reads an actual enumeration rather than
  any paragraph carrying the phrase, so a sentence contrasting the role with
  the cross-platform roles is no longer a false failure.
- New positive assertions: the Linux defaults still point at the declaration
  (REQ-B1.5 is positive, so absence of the old claim is only half of it), and
  main.yml's roles comment names the platform dispatch. That comment was the
  one corrected statement with no guard at all.
- The mise blurb is checked in both directions, its regex is non-greedy and
  accepts either TOML quoting, unreadable files are reported rather than
  skipped in silence, an empty file listing fails instead of certifying a
  repository it never read, git and PyYAML are checked up front, and the
  self-exclusion is by resolved path so a stray copy is not mistaken for it.

Planwright-Task: dev-services/5

Five assertion scripts under scripts/ now, and no single command runs them:
mise run lint covers the linters only, lefthook runs none, and CI exercises
roles rather than scripts. Surfaced during Task 5; recorded as seed material
rather than acted on.

Planwright-Task: dev-services/5

Inline correctness pass. A scan that died partway -- an unreadable
declaration, a malformed listing -- exits non-zero the same way a scan that
found a stale claim does, so the failure branch reported "files still place
services out of scope" and then listed none. The completion line is now
checked before the result is read, and the mutation that removes the
declaration produces a named refusal instead.

Planwright-Task: dev-services/5

Both jobs are cancelled by the 30-minute cap on every run, on main as well as
on PR branches, stalling in the Brewfile install with no error. Pre-existing
and branch-independent, so Task 5 records it rather than retrying into it:
the failure reproduces on main's last four runs, which is not the shape a
retry clears.

Planwright-Task: dev-services/5