Re-take the ruleset pastes against the rules the branches carry now

[iderex]

Closes #217.

What was wrong

Five pasted outputs in three tracked documents were taken on 2026-08-08 and
2026-08-09, and the ruleset on this repository's default branch was last written
on 2026-08-28. None of the five reproduces:

gh api repos/Flowfin/site/rulesets/20572614 --jq '{enforcement, bypass: .bypass_actors, required: [.rules[].type]}'
{"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request","required_signatures"]}
gh api repos/Flowfin/site/rulesets/20572614 --jq '.updated_at'
"2026-08-28T14:22:58.455+02:00"
gh api repos/Flowfin/jellyfin-plugin-sso/rulesets/18802863 --jq '[.rules[].type]'
["deletion","non_fast_forward","required_status_checks","pull_request","required_signatures"]

All run 2026-08-30.

Four of the five were a stale rule list under prose that stayed true. The fifth is
the one this change is really about. The parity ledger's section on what this
repository requires that the target does not answers Nothing, and argued it from
neither ruleset carrying the rule and from nothing at either branch refusing an
unsigned commit. Both clauses are false now. The answer survives, because both
branches gained the rule rather than one of them, so the row reached the right
answer from two readings that had stopped holding — and a ledger a reader consults
to learn where two gates differ is the worst place for that, since nothing about a
row that agrees with itself invites a re-run.

What the change does

Each of the five outputs is replaced by what its command returns today, with its
own Run line, and no paste is left undated. The parity paragraph keeps its
answer of Nothing and states the reason that now holds, that both branches carry
the rule and each refuses an unsigned commit; the sentence saying nothing at
either branch refuses one is gone rather than softened.

CONTRIBUTING.md gains one sentence beside its own paste, saying that a commit
reaching main has to be signed as well as signed off. The section under it
describes the DCO trailer and nothing else, so a contributor who read it learned
nothing about the rule that now refuses their merge.

git diff --name-only origin/main...HEAD
CONTRIBUTING.md
GOVERNANCE.md
docs/parity.md

The gate

go run . ci
gate: 7 legs, in order: format, vet, test, build, links, sitemap, invariants
  needs-network was not asked for. Asking costs a request to the public name from whatever machine runs it, and a verdict that moves when somebody else's service does rather than when this tree changes. Ask with: go run ./harness/needs-network
  format: ok, 74 file(s)
  vet: ok
  test: ok, 37 test file(s)
  build: ok, 22 file(s)
  links: every reference that stays inside this site resolves to a file the build wrote
  sitemap: every page the build wrote is listed once, and every entry has a page behind it
  invariants: ok, 39 rule(s) decided, 2 owed and not decided
7 of 7 legs ran. None was skipped.

go run . hygiene origin/main HEAD
hygiene: 1 non-merge commit(s) in origin/main..HEAD, origin internal
  78537e6c95f3: subject carries its reference
1 commit(s) judged, none refused.

Both run 2026-08-30 at 78537e6. The needs-network line is the set this gate
does not ask for, printed rather than skipped silently; the two verbs that reach
the network compare pinned versions and the vendored token file, and neither of
them reads a ruleset.

The means

Markdown, in the three documents that carry the pastes. Nothing is built and
nothing is added to the gate, so the change is the text and the commands that
produced it. A check comparing a pasted ruleset against the live one is not
proposed here and #217 says why: its verdict would move when a repository setting
moves rather than when this tree changes, which is the reason the two network
verbs already sit outside the gate.

No second reader

This change carries no second reader. The ruleset here requires no approving
review, so what stands in place of one is the evidence above: every replaced paste
is the output of the command printed beside it, run at 78537e6, and the gate and
the hygiene verb are quoted in full rather than summarised.

How it was found

By re-running the command under the paste in CONTRIBUTING.md while reading the
rule types for #47, rather than by anything in this tree. No leg of the gate
reaches the network and no verb here reads a ruleset, so nothing could have caught
it:

git grep -n 'rulesets/' -- internal/ main.go harness/ ; echo "exit=$?"
exit=1

Run 2026-08-30 at 78537e6.