Describe the second hygiene run a pull request here meets

[iderex]

The issue this belongs to

Closes #402

What changed

## What the gate runs, and what each thing refuses gains one entry, for the
second hygiene check-run a pull request here meets. It sits directly under the
local hygiene entry, because the two names are what a reader confuses, and it
says that the rules behind it are not in this tree.

Nothing else is touched. No workflow, no script, no register and no input.

What failure it prevents

Two check-runs land on every head here with names a hyphen and a word apart:

gh api repos/Flowfin/core/commits/4e06b1b308f57013221db49d3c8bdde7d409f360/check-runs \
  --jq '.check_runs[] | select(.name|test("hygiene";"i")) | "\(.name)\t\(.conclusion)"'
hygiene / Deterministic PR hygiene	success
Deterministic PR-hygiene checks	success

Before this change the document described one of them and the word that would
find the other was not in the file at all:

git grep -c -i 'shared' origin/main -- CONTRIBUTING.md ; echo "exit=$?"
exit=1

So a contributor meeting a red hygiene / Deterministic PR hygiene read the
paragraph about Deterministic PR-hygiene checks, was pointed at
.github/pr-hygiene/hygiene.sh, and read a script that did not produce the
refusal in front of them. What did is a workflow pinned by hash in another
repository:

gh api repos/Flowfin/core/actions/runs/35236886531 --jq '.name,.path,.event'
Shared hygiene
.github/workflows/shared-hygiene.yml
pull_request

This is the shape #326 closed for coverage and mutation one day ago. Those
two have their scripts in this tree; this one does not, which is the case where a
reader has the least chance of working it out alone.

Evidence

The commit being pushed:

git rev-parse HEAD
c604cd96af9c117172dffa578c092627f2b850c2
git diff --stat origin/main...HEAD
 CONTRIBUTING.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

The entry is there, under the name the run reports with:

git grep -n 'hygiene / Deterministic PR hygiene' HEAD -- CONTRIBUTING.md
HEAD:CONTRIBUTING.md:186:**`hygiene / Deterministic PR hygiene`** is a second hygiene run on every pull
git grep -c -i 'shared' HEAD -- CONTRIBUTING.md
HEAD:CONTRIBUTING.md:2

The path gate at this commit, which now reads two more named paths than it did
before the entry:

bash .github/doc-paths/doc-paths.sh check | grep 'names-a-path' -A1
-- names-a-path-that-resolves
ok    78 document(s), 378 named path(s) resolved, 0 excused as examples

What this does not cover

• What the shared check actually refuses. The called workflow is pinned by hash
  in another repository and I did not read it. The entry carries
  .github/workflows/shared-hygiene.yml's own statement of what the two checks
  have in common, quoted rather than re-derived, and claims nothing beyond it.
• branch-health-lever, the other workflow the section does not name. It
  declares no pull_request and no push trigger, so it produces no check-run
  on a head and is outside what this section walks. Nothing here adds it.
• The subject_names_issue input the shared call sets. The count that switches the shared subject rule off is refuted by this board's subjects, and its second half by the commit that wrote it #400 repaired the reason
  written beside it and closed without deciding the value; this touches neither.
• Any mechanism. Nothing compares the check-runs a head carries against the legs
  this section walks, so the next leg to arrive is absent from it in silence
  again, and no check is added here.

Who has read it

Nobody other than me has read this change. The evidence above stands in place of
a second reading rather than beside one.