The card-inset gate, outliving the defect it was written for (#215)

[bdelanghe]

Closes #215. Rebuilt on the rewritten homepage — what this PR is has changed, so here it is again honestly.

What's left of the original

The two provenance cards this branch was opened to fix no longer exist: the homepage rewrite (#219, merged as c7dceb8) cut them. The .provenance CSS went with them, and the copy fix went with the copy.

What remains is the part worth keeping.

The gate ships anyway

.card is still used by the three repo cards and the try-it card on the homepage, and across /map, /desk, /contracts and /conformance. The failure mode it guards — a card variant that forgets to declare an inset, so its copy renders flush against a 1px border — is a property of the component, not of the two cards that happened to have it first.

Retiring a gate because its first catch got fixed is how the second one ships.

✓ card-inset: 8 card render(s) across 13 page(s) × 2 width(s);
  all text ≥12px clear of its border

Eight renders, down from sixteen: the rewritten homepage carries half as many cards as the old one did.

One thing that had to be re-aimed

The mutation step injected .provenance { padding: 0 } — a class that is now absent. A mutation aimed at a class that's gone proves nothing and passes quietly, which is the exact failure the step exists to prevent. It strips .proof-card now, and the workflow's own script (extracted from the YAML, not retyped) takes the gate red on 6 cards.

That is the second time this lane's self-test has been wrong in a way that looked green. The first was a probe I validated as a hand-copy while CI ran a different one. Both times the fix was to run the committed script rather than a retyping of it.

Also here

The path-traversal fix. CodeQL was right that join("dist", req.url) escapes the root — verified, join("dist", "/../../../../etc/passwd") resolves to /etc/passwd. The server now serves from an allowlist built by walking dist, so no filesystem path is derived from a request at all. That's the org's own default-deny reasoning — unknown is not permission — with the property a filter can't have: an escape nobody thought of has nothing to escape into.

The lane proves it, over a raw socket because fetch() and every browser normalize .. out before sending:

HTTP/1.1 404 Not Found   /../../../../etc/passwd
HTTP/1.1 404 Not Found   /%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
HTTP/1.1 404 Not Found   /../../scripts/check-card-inset.mjs
HTTP/1.1 404 Not Found   /../package.json
✓ nothing outside dist/ is reachable; real routes still are

check-jargon keeps the comment strip, completed to (?:-->|$) so an unterminated comment swallows to end of file rather than surviving it. An authoring note that names a term was demanding a link for text that never renders.

Verified

20 checks green on 85f1ddf, including this PR's own card-inset lane and CodeQL. Locally: npm run check, brand content / coverage, axe (13 pages, 0 serious), the traversal probe and the mutation step both run from the committed workflow.