docs(ci): correct the shard-classifier comment to describe the post-#6589 classifier

[claude]

Fixes #10713

The Compute this shard's package set step in .github/workflows/ci.yml justified its
git cat-file -e spelling with three claims about scripts/check-shard-attestation.mjs.
All three describe the classifier as it stood before #6589. This corrects the comment
only — the step's behaviour is untouched and git cat-file -e stays.

The comment was authored in e4737b6ac2 (#6195) and the classifier was rewritten later
the same day in 4e271b2c67 (#6589), so the text has described a classifier that no
longer exists ever since.

The three claims, re-derived from the classifier source

Each row was settled against the code, not against the script's docblock (which is prose
and could itself have gone stale) and not against the card's table.

The comment claimed	What the current source does	Verdict
classification reads "the job's joined run: text"	scanWorkflow builds jobInvokes = (job, flag) => stepsOf(job).some((step) => invokesScript(step?.run, flag)) and classifies with if (!jobInvokes(job, '--verify')) continue;	false — applied per STEP
the flag counts "as a bare substring"	invokesScript lexes the text into commands, locates the token equal to SCRIPT_BASENAME (or ending / + it), then requires token === flag || token.startsWith(flag + '=') among the tokens after it in that same command	false — an exact argument token, adjacent within one command
"including in a comment, since comments are part of run:"	shellCommands hits if (ch === '#' && atWordStart), skips to the newline and flushes	false — # comments are dropped

Two details worth recording, because neither is visible from the docblock alone:

• The joined text has not disappeared — runTextOf(job) is still built, but only after
  a job has already been classified as a gate, and only to extract its --leg tokens. It
  no longer participates in classification at all.
• Per-STEP and per-COMMAND are belt-and-braces here: runTextOf joins with a newline, and
  the lexer already treats a newline as a command boundary. Either guard alone would defeat
  the check-shard-attestation.mjs misclassifies a shard job as an aggregate gate on a bare --verify substring anywhere in its run: text (false red, measured) #6589 shape.

Why the corrected comment now spells --verify literally

The old comment went out of its way to write "dash-dash-verify" instead of the flag. That
avoidance is no longer necessary, and demonstrating it is the point — so the replacement
names the flag three times, in the very step that already carries the script's basename in
its --emit step. That makes this the load-bearing measurement rather than a vacuous one:

WITH MY EDITED ci.yml on disk:
  joined run: text contains "check-shard-attestation.mjs" : true
  joined run: text contains "--verify"                    : true
  PRE-#6589 co-occurrence rule  => job `test` is a GATE ?  : true
  CURRENT invocation classifier => job `test` is a GATE ?  : false
  still classified an attesting SHARD (--emit)            : true

The pre-#6589 rule quoted there (text.includes(BASENAME) && text.includes('--verify')) is
the one the classifier's own docblock records as the defect #6589 removed. The safety of
this text is pinned upstream by two --self-test assertions — a --verify-in-a-comment
fixture and a trailing-comment fixture.

Evidence

pnpm check:shard-attestation, before and after, verdict lines quoted — the shard job's
classification is unchanged:

BEFORE  exit=0
  ✓ check-shard-attestation --self-test: 92 assertions (dominance experiment + both #6082 counter-examples + the #4928 guard + the #6589 classifier pins).
  ✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).

AFTER   exit=0
  ✓ check-shard-attestation --self-test: 92 assertions (dominance experiment + both #6082 counter-examples + the #4928 guard + the #6589 classifier pins).
  ✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).

Gate union re-derived by node scripts/pm/dispatch-gates.mjs (no paths passed — it takes
its own change set) and re-run at final commit db6e53c3bd. Exit codes captured with
cmd > file 2>&1; ec=$?, never through a pipe:

Gate	Exit
pnpm check:node-version	0
pnpm check:required-contexts	0
pnpm check:shard-attestation	0
pnpm check:workflow-status-functions	0
node scripts/check-aggregator-roster.mjs	0
node scripts/check-required-contexts.mjs	0
node scripts/check-shard-attestation.mjs	0
pnpm check:nul-bytes	0

dispatch-gates named exactly the four workflow-parsing families the card predicted, plus
the shard/required-contexts duplicates from their other workflows; it added nothing my diff
did not touch. No scripts/** path is touched, so the check:entry-guard /
check-parse-guard.mjs blind spot does not apply here.

No ablation applies. A comment correction has no guard under test — there is no mutation
whose removal could turn anything red, and the counterfactual above is the honest substitute:
it shows the edit would have flipped the classification under the classifier the comment
describes.

Scope

• No behaviour change. git cat-file -e vs git rev-parse was explicitly out of review;
  the command is byte-identical.
• The FILTER CONTRACT (filter job 一旦失败,Test Core / Build Core / Dogfood 会全部 skipped 而分支保护判为通过 —— 隐式 success() 今天已第三次咬人 #4928) governs the filter job; this is the test shard job, and
  nothing inside that contract's boundary is touched.
• scripts/check-shard-attestation.mjs is not edited. The classifier is correct; the
  comment describing it was not.
• Workflow comment only, so nothing publishes — no changeset, skip-changeset applied.

Generated by Claude Code

---

Generated by Claude Code