fix(audit): correct the census total to 333, and the stale #17 tense in the gate header (#871)

## What

Two self-inflicted defects in the artefacts that merged as #869, both
caught by re-reading them against the census data they quote.

**1. The audit miscounted its own census.** It said *337 required
contexts across 179 repositories*; the verdicts it prints alongside
(app-owned 168 + producible 156 + app-named 4 + unsatisfiable 5) total
**333**. Corrected, plus the fact that all 333 were ruleset-sourced, so
no repository in the census still enforced required status checks
through legacy branch protection.

**2. The gate's header described `hyperpolymath/tropical-types#17` in
the present tense** ("the wrapper publishes `scan / Hypatia
Neurosymbolic Analysis`"). That repository publishes the bare name from
an inline job and the prefixed name from its wrapper caller now — the
sentence was stale on merge.

Also records why the five unsatisfiable contexts matter rather than
being app-configuration work: every one binds `integration_id: 15368`
(GitHub Actions), so they are repository-owned workflow job names. No
external publisher could ever satisfy them, and the fix is a rename or a
re-armed rule, not a settings tweak.

## Why it is worth a PR rather than a quiet push

The whole point of this audit is that unverified claims about CI state
are how a required context becomes unsatisfiable without anyone
noticing. A census document that miscounts its own census, and a header
that describes a fixed condition as live, are the same failure at one
remove.

## Verification

* `bash scripts/tests/check-required-contexts-test.sh` — 5/5 pass
(unchanged by the edit; run to confirm nothing else moved).
* `bash -n scripts/check-required-contexts.sh` — parses.
* Counts cross-checked against the census records: 333 contexts over 179
repositories, 5 unsatisfiable in 4 repositories (`awesome-gleam` ×2,
`casket-ssg`, `coord-tui`, `vext`), all `integration_id: 15368`.

Author: hyperpolymath

docs/audits/audit-ci-context-producibility-2026-09-20.adoc

@@ -66,7 +66,9 @@ those names. The audit's subject is the residue the *repository itself* owns.
 
 == Results
 
-337 required contexts across 179 repositories, read from branch rulesets:
+333 required contexts across 179 repositories, read from branch rulesets
+(every one ruleset-sourced: no repository in the census still enforced required
+status checks through legacy branch protection):
 
 [cols="1,1,2"]
 |===
@@ -90,8 +92,10 @@ those names. The audit's subject is the residue the *repository itself* owns.
 |===
 
 That is a good result for the estate and a poor one for the five rules: the class
-is rare, which is exactly why it hides. The residues, all in auxiliary
-(`Optimus-Branch`, `Base`) rulesets:
+is rare, which is exactly why it hides. All five carry `integration_id: 15368`
+(GitHub Actions), so they are repository-owned *workflow job names* rather than
+third-party app names — nothing outside the repository could ever publish them.
+The residues, all in auxiliary (`Optimus-Branch`, `Base`) rulesets:
 
 [cols="2,1,2,2"]
 |===
@@ -104,6 +108,13 @@ is rare, which is exactly why it hides. The residues, all in auxiliary
 | `hyperpolymath/vext` | Optimus-Branch | `CodeQL Analysis (actions, none)` | stale job-name + matrix tuple
 |===
 
+Each one was re-checked per ruleset on 2026-09-20 and is a live defect, not an
+artefact of evaluating the wrong ref: every carrying ruleset is `active`, every
+one binds `~DEFAULT_BRANCH` (these repositories have a single branch,
+`main`), and every context carries `integration_id: 15368`. Note the naming
+irony in three of them — a ruleset called `Optimus-Branch` guarding the default
+branch.
+
 Each one is the same defect as tropical-types#17 in a different costume: the
 requirement names a check that used to exist. The fix is one of the two honest
 options below; the diagnostic is

scripts/check-required-contexts.sh

@@ -12,8 +12,10 @@
 # rule requiring a name nothing publishes is an unsatisfiable requirement: every
 # pull request stays BLOCKED, the CI board shows green, and nothing on the CI
 # side names the cause. Observed in hyperpolymath/tropical-types#17 (the bare
-# `Hypatia Neurosymbolic Analysis` required while the wrapper publishes
-# `scan / Hypatia Neurosymbolic Analysis`), and catalogued for the wrapper case in
+# `Hypatia Neurosymbolic Analysis` required while the wrapper published
+# `scan / Hypatia Neurosymbolic Analysis`; that repository now publishes the bare
+# name from an inline job and the prefixed name from its wrapper caller), and
+# catalogued for the wrapper case in
 # docs/audits/audit-hypatia-pin-orphan-2026-05-27.adoc.
 #
 # THE RULE THIS ENCODES