docs: document a local runner for the machine-specific-paths gate

[kyle-sexton]

Closes #3522

Summary

The README "Local pre-flight for hygiene gates" table still listed machine-specific-paths as "Parked: there is no local runner". Per the owner decision on #3522 (option d, Q1 mapping table ratified), that row now carries a real local command: the pinned composite's own entry script, run from a ci-workflows checkout.

Fix

• README.md: replaced the parked row with the runnable command, added a "Running machine-specific-paths locally" section (read the pinned SHA and exclude: list from ci.yml, check out ci-workflows at that SHA, run the script from this repo's root with EXTENSIONS and EXCLUDE), and rewrote the Claim/Basis/As of/Recheck record. The exclude list is pointed at in ci.yml, not copied.
• No plugin files changed, so no version bump or changelog entry. No ci-workflows change.

Verification

• Ran the documented command from the repo root against the pinned ci-workflows script: it runs standalone (needs only EXTENSIONS and EXCLUDE, exits 0 clean / 1 findings).
• markdownlint-cli2 README.md: 0 issues.
• bash scripts/check-purged-em-dashes.sh: no em dashes.
• bash scripts/check-shell-portability.sh origin/main: no shell files in scope.
• python3 scripts/sync-plugin-options-docs.py --check: up to date.
• bash scripts/check-changelog-parity.sh --check --check-order: passes.
• bash scripts/validate-plugins.sh: all manifests and the catalog validated.

Related

• Hygiene gates that only report on a CI round-trip: local pre-flight discoverability #3522 (this issue), fix(guardrails): make the drive-root /tmp guard see a Write, not only a command #3503 (origin of the four CI round-trips)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T18:34:37.696885Z	6f6eff8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 21s —— View job

---

Security review

• Gather context (PR diff, changed files)
• Apply skip gate
• Post result

Skipped — no security-relevant surface.

The diff touches only README.md (+28/-11): it replaces the "Parked: there is no local runner"
row for machine-specific-paths with the pinned ci-workflows composite's own entry script
command, and adds a "Running machine-specific-paths locally" section explaining how to read the
pinned SHA/exclude list from ci.yml, check out ci-workflows at that SHA, and run the script
with EXTENSIONS/EXCLUDE set.

No code, workflow, script, permission, or configuration file changed — this is prose describing a
manual, local-only invocation of an existing external script that already ships in
melodic-software/ci-workflows. README.md is not an instruction file this lane's
instruction-surface-deletion lens covers (CLAUDE.md, AGENTS.md, a rules file, a skill/agent
body, a hook allow/deny list), so that check doesn't apply either. Skip gate item 2 ("change has
no security-relevant surface") applies; no findings to report.