The five config files at the root were the last French the guard never scanned (ZED-73) - #61

…r scanned

ZED-64 decided D3 ("comments and docs in English") means everything, with no
carve-out by file type. `tests/french_guard.py` still excludes `.github/`,
`pyproject.toml` and the repository `copier.yml` by name, and its own docstring
justifies the exclusion with the superseded rule. Widening its scope needs
these files clean first; this is that work.

Measured, not hand-grepped: running the guard's signals over the five files
reported 26 lines -- the 21 the issue lists under the two signals it was
written against, plus 5 more that ZED-69's `nouns` signal finds in the ci.yml
step names (`Installer les outils du domaine Ansible` and its four siblings).
All 26 are now zero, so none of these files needs a baseline entry when the
scope widens.

What changed, and nothing else: comments, the `name:` of 13 workflow steps,
three shell log strings, and the prose half of the `integration` pytest marker
description. No key, job id, environment name, path, URL, version, checksum,
classifier or keyword is touched -- `git diff` shows 19 non-comment lines and
every one of them is display text. The step names are not referenced anywhere
(`needs:` keys on jobs, which were already English), and nothing in the tree
greps for the old strings.

Two things deliberately preserved rather than shortened away:

* `release.yml`'s threat model. The header still explains why Trusted
  Publishing means no PyPI secret exists in the repository, why
  `id-token: write` is the single permission the publish jobs add, and why the
  two triggers are asymmetric. The `uses:`-pinning comment in `build` still
  spells out the job boundary it protects: that job holds no `id-token` and
  cannot publish, but it can alter `dist/` before the upload, and the job that
  does hold `id-token` then sends that artifact to PyPI under our identity,
  permanently.
* `ci.yml`'s reason for existing. CI is authoritative because it is the only
  Linux environment where every domain's validators run natively, and an
  `integration` test that skips makes a green suite mean nothing.

`src/forge/plugins/demo/template/fins-de-ligne.txt` in `.gitattributes` stays
as it is: the French file *name* is ZED-23's, and renaming it here would move
the witness out from under the normalisation test in the same commit that
translates its comment.

Not here, each for its own reason: `tests/specs/*.yml` and `tests/golden/**`
(ZED-27, derived output -- fix the spec and regenerate, never the golden),
`CHANGELOG.md` (its French is quoted migration before/after, correct as-is and
destined for the guard's `[allowed]` section), and `DESIGN.md:186` (`façade`,
an English word and a guard false positive).

No changelog entry: `CHANGELOG.md` records what forge puts in a user's
repository, and this is prose in the forge repository's own configuration.

Verified: the guard's three signals report 0 across all five files; all three
YAML documents and `pyproject.toml` still parse, with `release.yml`'s per-job
permissions intact (`build` none, `testpypi` and `pypi` `id-token: write`);
`pytest tests/test_render.py tests/test_cli.py tests/test_golden.py` is 83
passed, 1 skipped, and the golden trees are byte-identical, which is what
proves the `copier.yml` edits are inert.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Paperclip <noreply@paperclip.ing>

…re gone

ZED-64 widened the French guard to the whole repository and parked the cost of
that widening in `tests/french_baseline.txt`: 26 lines across the five root
config files, all owned by ZED-73. This branch is ZED-73, so those 26 lines are
now 0 -- and the guard says so, loudly. `test_the_baseline_is_not_ahead_of_the_tree`
is a failing test on this branch today, on all three interpreters:

    tests/french_baseline.txt is behind the tree. Translation progressed,
    which is the point -- record it:
      words | 1 | .gitattributes                 ->  delete the entry
      nouns | 5 | .github/workflows/ci.yml       ->  delete the entry
      words | 5 | .github/workflows/ci.yml       ->  delete the entry
      words | 4 | .github/workflows/release.yml  ->  delete the entry
      words | 7 | copier.yml                     ->  delete the entry
      words | 4 | pyproject.toml                 ->  delete the entry

The entries go, and the paragraph that described them says what happened to
them instead of predicting it. The `[baseline]` section is empty again, which is
where it was before the scan widened.

Found by the first matrix run this branch has ever had: it was parked by D6
before `scripts/docker-matrix.sh` existed, so nothing had executed its own test
suite end to end. The six-line bookkeeping was the only thing missing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>