Leave the sign-on gate's three head readings as the commands that produced them

[iderex]

The issue this belongs to

Closes #388

What changed

docs/gate-parity.md opened on three readings taken from the head of the
sign-on plugin's default branch, each pasted under the command that produced it:
fifteen check-run names, a repeat count over the same list, and a job URL. All
three outputs are deleted and their commands left standing alone, which is the
move this file already took further down for its own workflow list. The one
reading still needed is pinned to the commit that wrote it rather than re-pasted,
and the paragraph carrying the job URL now says where the run id under it came
from.

What failure it prevents

A reader measuring this repository's gate against the sign-on plugin's compares
two lists, and the list they were handed was one the command beside it
contradicted. That head is not this repository's, so it moves whenever that board
pushes and nothing here notices.

The count sentence was the worse half. It told a reader what the deduplication in
the command is for using a number that is now zero, in a paragraph whose own
first sentence already said the paste moves.

This is a correction, and it has already happened rather than being a risk. How
it was found: I re-ran every paste in this tree sitting under a gh command,
which is a seam a sweep by git command alone does not reach.

Evidence

Read at the commit being pushed, 55ed63b, against the sign-on plugin's default
branch at dee0b596a9058ecb56e89f009a741fce1f5bb016.

The first reading pasted fifteen names and the command answers fourteen. Pinned
to the commit that wrote it, so this reading reproduces after the deletion:

git show a5c1bba:docs/gate-parity.md | sed -n '29,43p' | sed 's/^    //' | sort > pasted
gh api repos/Flowfin/jellyfin-plugin-sso/commits/main/check-runs --jq '.check_runs[].name' | sort -u > live
echo "pasted $(wc -l < pasted)  live $(wc -l < live)"
pasted 15  live 14
comm -23 pasted live
Report any workflow that concluded non-success on the default branch

The name that left is the one the sentence under it counted six times, so the
second reading went with it. No name appears twice on that commit now:

gh api repos/Flowfin/jellyfin-plugin-sso/commits/main/check-runs --jq '.check_runs[].name' | sort | uniq -c | sort -rn | head -3
      1 wiki-lint
      1 submit-nuget
      1 Scorecard analysis

The third pasted a job URL from the same head, which names a different run now:

gh api repos/Flowfin/jellyfin-plugin-sso/commits/main/check-runs --jq '.check_runs[] | select(.name == "submit-nuget") | .html_url'
https://github.com/Flowfin/jellyfin-plugin-sso/actions/runs/34981745754/job/104423522996

The pinned id it hands on still answers, which is why that command and its output
are kept where the other three outputs go:

gh api repos/Flowfin/jellyfin-plugin-sso/actions/runs/31521364131 --jq '{name: .name, path: .path}'
{"name":"Automatic Dependency Submission (NuGet)","path":"dynamic/dependency-graph/auto-submission"}

All three were right when they landed, and nobody opened those paragraphs since:

git log -S'6 Report any workflow that concluded non-success' --format='%h %ad %s' --date=short -- docs/gate-parity.md
a5c1bba 2026-08-12 Write the parity table against the gate on the sign-on plugin (#134)

The head this change is, in the shape the gate asks for:

git rev-list --count --no-merges origin/main..HEAD
1
git diff --name-only origin/main...HEAD
docs/gate-parity.md

The three document checks that read this file, run at this commit:

bash .github/doc-paths/doc-paths.sh check
Every path these documents name resolves against the tracked set.
bash .github/invariants/invariants.sh check
Every rule above was applied to its subject and refused nothing.
bash .github/statements/statements.sh check
Every directive this repository excludes has a published statement saying why, and what is consequently not looked for.

What this does not cover

• The parity table's verdict column. Eight parity rows wait on a register that closed with every entry answered #377 is where the eight waiting rows are,
  and nothing here reads or moves a verdict.
• The workflow-file listing further down the same section. It is read from a
  clone of that board rather than from its head, it is a different command, and
  the paragraph under it already hands the reader a derivation for its count.
• Any route that would notice the next time a reading of another board's head
  moves. Nothing here compares a paste against its command on any schedule, and
  what found these three was a re-run by hand.
• Whether any other paste in this tree sitting under a gh command has moved. I
  re-ran that seam and two further sites came back changed, in
  docs/decisions/0303-the-licence-the-core-is-offered-under.md and
  docs/decisions/0113-the-target-triples-the-gate-compiles-for.md. Both are in
  landed decision records, where the repair is held by an open rule question, so
  neither is touched here; each is written on the issue whose decision governs
  it.
• I ran no suite. This change edits one document, and nothing under src/ or
  tests/ is reached by it, so the compile and test legs are unexercised by
  anything in this diff rather than reported as green by me.

Who has read it

Nobody other than the author has read this change. There is no second reader on
this board tonight, so the evidence above stands in place of one: every number in
it carries the command that produced it, and the two readings that are needed
after the deletion are pinned to fixed commits rather than to a head that moves.