fix: five audit findings — origin term shape, non-string keys, a quadratic scan, and two unfollowable documents

[sinkog]

1. The origin term's shape (adversarial, additional gaps)

INV-013 says the grammar has exactly four productions. The sequence was matched against them; the sealed constructor was not. Both implementations accepted:

origin: [{sealed: {template: $t, path: $.a, extra: junk}}]
origin: [{sealed: {template: [a, b], path: $.a}}]

A term with a third member, or a template that is a sequence, is no production the grammar contains. The same presence-versus-shape mistake the sequence check fixed one level up — one level down. Both now require exactly two members, both scalars.

2. Non-string mapping keys (adversarial, additional gaps)

Go read a key through the YAML node's textual .Value without looking at its tag, so 1: x arrived as the name "1" — indistinguishable from '1': x, which is a different key in YAML, in a model whose purpose is unique addressing. Rust refused such documents outright.

The two did not agree on which names a document contains.

Go now rejects the key form; the quoted spelling is still refused for the ordinary reason (nothing declares it).

The Go test asserted the old behaviour — INV-029, "the key is not declared" — a rejection for the wrong reason. One of its cases was explicitly left unpinned, with a comment saying pinning it would pin behaviour nobody designed. It is designed now.

3. A quadratic scan, twice (adversarial F-08)

The duplicate-key pre-scan carried a comment claiming it is linear in the input's own size. It ran Vec::contains before every push — n(n-1)/2 comparisons — and Map::insert searched the whole vector again per key. Two quadratics, one comment.

before   10k 1.0s    20k 2.9s    40k 11.6s   (389 KB)
after    10k 0.20s   20k 0.26s   40k 0.45s   80k 0.75s

A set for the scan, and an append for the parser — safe because the scan has already refused duplicates, so there is nothing to overwrite.

4. The descriptor could not validate against its own schema (claim F-02)

project.yaml declares repo_type: spec; project.schema.yaml permitted schema, workflow, module. Added — and worth saying why it survived: nothing runs that validation.

5. Two documents that could not be followed (claim F-09)

docs/{en,hu}/workflow.md and both cheatsheets instructed make release-dependency and make release-schema. Neither target has ever existed here — both inherited from the base template — so make -n returns "No rule to make target", and anyone following either page could not begin.

Replaced with the real path: subject → verify → external review → pull request into main. Each page says what it used to say and why that was impossible, rather than quietly becoming correct.

---

make ci passes. Go 90.6%. 15 of 37 audit findings closed.