Name the clone in the parity block, which was reading this tree instead

[iderex]

Closes #395

What changed

docs/gate-parity.md:76 ran an awk over the relative glob
.github/workflows/*.yml, with twenty-four rows of the sign-on plugin's workflow
files pasted under it. It names the clone in its own argument now, the way the
three commands above it name it with -C. The sentence introducing the section
said everything below it was measured inside that clone; it is narrowed to the
block that is, and the paragraph beside it records what it said and why.

The failure it prevents

This repository carries .github/workflows/ as well, so the block answered out
of this tree and returned 0. What made that expensive is how close the wrong
answer looks. The two gates share eight file names:

comm -12 <(git show origin/main:docs/gate-parity.md | sed -n '77,100p' | sed 's/^    //' | cut -d' ' -f1 | sort) <(git ls-tree --name-only origin/main .github/workflows/ | sed 's#.*/##' | sort) | tr '\n' ' '
build.yml codeql.yml dco.yml dependency-review.yml pr-hygiene.yml scorecard.yml unicode-guard.yml zizmor.yml

and five whole rows come back the same, triggers and workflow name included:

comm -12 <(git show origin/main:docs/gate-parity.md | sed -n '77,100p' | sed 's/^    //' | sort) <(awk '<the block at docs/gate-parity.md:76 on origin/main, verbatim>' .github/workflows/*.yml | sort)
dco.yml | pull_request, | DCO
dependency-review.yml | pull_request, | Dependency review
scorecard.yml | branch_protection_rule,schedule,push, | Scorecard supply-chain security
unicode-guard.yml | push,pull_request, | unicode-guard
zizmor.yml | push,pull_request, | Workflow Security Analysis

That block is the one this file calls the set that decides parity, so a reader
comparing this board's gate against the other one could be comparing it against
itself and getting five rows of agreement for it.

How the state arose

Until fd53a61 the section carried cd ssoclone && git rev-parse HEAD:

git show fd53a61^:docs/gate-parity.md | sed -n '22,24p'
    git clone --depth 1 https://github.com/Flowfin/jellyfin-plugin-sso ssoclone
    cd ssoclone && git rev-parse HEAD
    54c5bf468a4f8719309fd59aa7f448ab17bfbbf8

That pair was replaced by three commands naming the clone with -C, which is the
right shape for the sha it anchors and is not what this change argues with. It
was also the only command in the file that moved a reader's working directory,
and there is none on origin/main:

git grep -nE '(^|[^a-z])cd ' origin/main -- docs/gate-parity.md ; echo "exit=$?"
exit=1

The evidence that the repair holds

The head being pushed is e33656bfbfa67e2587adf8d7176df0d550c81875. The block
taken verbatim out of that commit, run in a directory holding a clone the
section's own three commands make, returns the twenty-four rows the file pastes:

git -C ssoclone rev-parse HEAD
54c5bf468a4f8719309fd59aa7f448ab17bfbbf8
diff <(git show HEAD:docs/gate-parity.md | sed -n '90,113p' | sed 's/^    //' | sort) \
     <(awk '<the block at line 89 of that commit, verbatim>' ssoclone/.github/workflows/*.yml | sort) ; echo "exit=$?"
exit=0

The awk strips the directory off FILENAME, so prefixing the glob changes no
row. The two commands both pass:

cargo build --locked --all-targets ; echo "exit=$?"
exit=0
cargo test --locked 2>&1 | grep -c '^test result: ok' ; echo "exit=$?"
10
exit=0

and the two document checks this change could reach:

bash .github/doc-paths/doc-paths.sh check | tail -1
Every path these documents name resolves against the tracked set.
bash .github/decision-records/decision-records.sh check | tail -1
Every narrowing these records declare is named from both ends.

The trap, which is worth more than the repair

The comparison above has to be sorted, and one that is not says the opposite.
Unsorted, the same two outputs differ on three lines, because the order a glob
expands in is the reader's collation. The paste was taken under a locale-aware
one, where prettier.yml precedes pr-hygiene.yml; a shell in the C locale puts
the hyphen first, reverses that pair and moves publish.yml below its five
publish- neighbours:

(cd ssoclone && LC_ALL=en_US.UTF-8 bash -c "ls .github/workflows/*.yml") | sed -n '12,14p'
.github/workflows/prettier.yml
.github/workflows/pr-hygiene.yml
.github/workflows/publish.yml

Both orders hold the same twenty-four names. A re-run reported without the sort
would condemn a block that is entirely right, which is the direction this board
has already recorded twice today for a bash wrapper and for jq line endings.

What this does not cover

• No guard refuses the next one. doc-paths reads no indented block by
  design, because the paths in them are frequently another repository's, and its
  own output says so. A bare relative glob inside a block is refused by nothing
  here, and this change adds no check.
• The rest of the file's paste seam. Only the commands that decide which tree
  is read were examined. Whether each pasted output still reproduces is the sweep
  recorded on The plan for this repository, in build order, and what it leaves out #98 and is not re-taken here.
• The other two of this file's three gh readings of the plugin's head. They
  reach the network and were not run for this change.
• Whether the parity table's verdicts are right. Nothing here reads a row.

Who has read it

Nobody but me. This board has no second reader tonight, so the evidence above
stands in place of one: every claim carries the command that produced it, run at
e33656bfbfa67e2587adf8d7176df0d550c81875 or at the reference named beside it.