docs(ci): point the governed-merges step comment at the register, not a hand copy

The `Governed-merges audit self-test` step comment restated the five governed
surfaces (`docs/adr/**`, `.claude/**`, `skills/**`, `AGENTS.md`, `CLAUDE.md`)
inline. Nothing read that copy, and the register it copies has grown three
times in two days; the two hand copies a seat actually acts on went stale twice
before `check:pm-governed-prose` pinned them.

That pin asserts over backtick code spans inside an anchored region, which a
bare YAML comment cannot present, so extending it here would mean recognising
path-shaped literals in free text. Deleting the copy is the smaller surface and
removes the drift structurally rather than detecting it: the comment now points
at `GOVERNED_SURFACES` in `scripts/pm/check-governed-merges.mjs`, the way the
sibling step comment already points at its own script, and says why the list is
not restated so the next author does not helpfully re-add it.

Comment-only: the parsed workflow is structurally identical to `origin/main`
(same jobs, same `Lint & Repo Gates` name, same 70 steps, same `run:` lines).

Part of #9840

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XqDQYVU5smx29ts9pAErja

Author: claude

.github/workflows/lint.yml

@@ -284,12 +284,22 @@ jobs:
 
       # Governed-merges audit self-test (#9495) — same family, same split as
       # the half-state sweeper above: the live sweep enumerates the governed
-      # merges (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md)
-      # since a date/ref for the PM round report — report-only by design, the
-      # human-merge-is-the-review-record regime's detection half — while this
-      # step runs only the offline self-test (pure predicates + replay
-      # fixtures; no network, no token), so the predicates cannot rot unrun
-      # the way an uninvoked self-test does (#4690).
+      # merges since a date/ref for the PM round report — report-only by
+      # design, the human-merge-is-the-review-record regime's detection half
+      # — while this step runs only the offline self-test (pure predicates +
+      # replay fixtures; no network, no token), so the predicates cannot rot
+      # unrun the way an uninvoked self-test does (#4690).
+      #
+      # ⛔ WHICH surfaces are governed is deliberately NOT restated here
+      # (#9840). The register is `GOVERNED_SURFACES` in
+      # `scripts/pm/check-governed-merges.mjs`, and this comment used to spell
+      # the five out by hand — a copy nothing read. The register grew three
+      # times in two days, and the two hand copies a seat DOES act on went
+      # stale twice (#9395, #9511); those two are pinned by the step below,
+      # over backtick spans inside an anchored region. A bare YAML comment
+      # cannot present that shape, so this one points at the register rather
+      # than restating it: the copy that does not exist cannot go stale.
+      # ⛔ Do not helpfully re-add the list here.
       - name: Governed-merges audit self-test
         run: pnpm check:pm-governed-merges