chore(debt): re-measure Debtfile probes

.machine_readable/Debtfile.a2ml

@@ -27,8 +27,8 @@ forgotten.
 ### docs-md-not-adoc
 - description: Docs under docs/ still in Markdown; estate policy is AsciiDoc (.adoc) except the four GitHub-required .md files
 - probe: git ls-files 'docs/**/*.md' 'docs/*.md' | grep -vEi '(SECURITY|CONTRIBUTING|CODE_OF_CONDUCT|CHANGELOG)\.md$' | wc -l
-- count: 309
-- ceiling: 309
+- count: 1
+- ceiling: 1
 - severity: low
 - policy: remediable
 - tri: substitute
@@ -39,7 +39,7 @@ forgotten.
 ### gate-scripts-without-tests
 - description: Scripts under scripts/ with no matching scripts/tests/<name>-test.sh — a gate with no test has never been shown able to fail
 - probe: n=0; for f in $(git ls-files 'scripts/*.sh'); do b=$(basename "$f" .sh); case "$b" in *-test) continue;; esac; if [ ! -f "scripts/tests/${b}-test.sh" ] && [ ! -f "scripts/tests/${b#check-}-test.sh" ] && [ ! -f "scripts/tests/${b#run-}-test.sh" ]; then n=$((n+1)); fi; done; echo "$n"
-- count: 31
+- count: 33
 - ceiling: 31
 - severity: high
 - policy: remediable
@@ -51,7 +51,7 @@ forgotten.
 ### shell-scripts-missing-spdx
 - description: Shell scripts under scripts/ without an SPDX-License-Identifier in the first three lines
 - probe: n=0; for f in $(git ls-files 'scripts/*.sh'); do head -3 "$f" | grep -q 'SPDX-License-Identifier' || n=$((n+1)); done; echo "$n"
-- count: 2
+- count: 3
 - ceiling: 2
 - severity: medium
 - policy: remediable
@@ -61,8 +61,8 @@ forgotten.
 ### todo-fixme-markers
 - description: Files carrying a TODO or FIXME marker. Advisory — a marker is a note to self, not a defect
 - probe: git grep -I -l -E '\b(TODO|FIXME)\b' -- . ':(exclude).machine_readable/Debtfile.a2ml' ':(exclude)docs/DEBTFILE-SPEC.adoc' | wc -l
-- count: 276
-- ceiling: 276
+- count: 76
+- ceiling: 76
 - severity: low
 - policy: remediable
 - tri: control
@@ -79,8 +79,8 @@ forgotten.
 # 7: an 84x over-count. Estate-wide the same error inflates 1,768 to 4,952, and
 # it is the number standards#308 has been quoting.
 - probe: git grep -l -E '^[^a-zA-Z0-9]*SPDX-License-Identifier:.*PMPL-1\.0' -- . | wc -l
-- count: 7
-- ceiling: 7
+- count: 4
+- ceiling: 4
 - severity: medium
 - policy: flag-only
 - tri: control
@@ -90,7 +90,7 @@ forgotten.
 ### deno-residue
 - description: Deno residue in this repository after the Bun ruling. `governance-reusable.yml` still runs `denoland/setup-deno`, which INSTALLS DENO ON EVERY ESTATE REPO ON EVERY RUN; `deno-ci{,-reusable}.yml` still ship the failing `deno / Deno CI`; `scripts/check-ts-allowlist.deno.js` is a worked Deno example in scripts/; and `docs/migrations/npm-to-deno-template/` is a live recipe pointing repos AT the retired runtime. Owner ruled Deno REMOVED and Bun permanent (said three times, reaffirmed 2026-08-07). Must reach 0. Excludes */bindings/deno/, which is interop for OTHER people's Deno code and a separate question.
 - probe: git grep -lE "denoland/setup-deno|deno run|deno test|deno fmt|deno lint" -- ".github/workflows/*.yml" "scripts/*" | wc -l
-- count: 4
+- count: 5
 - ceiling: 4
 - severity: medium
 - policy: remediable
@@ -100,8 +100,8 @@ forgotten.
 ### deno-artefacts
 - description: Files that exist only to serve Deno — the deno-ci workflow pair, the compiled check-ts-allowlist.deno.js, and the npm-to-deno migration template. Deleting these is the completion of the Bun migration, not a precondition of it. Excludes */bindings/deno/.
 - probe: git ls-files ".github/workflows/deno*" "scripts/*deno*" "docs/migrations/npm-to-deno-template/*" | wc -l
-- count: 6
-- ceiling: 6
+- count: 5
+- ceiling: 5
 - severity: medium
 - policy: remediable
 - tri: substitute