chore(distribution): delete the zero-target component defs

[kyle-sexton]

Closes #429

Phase 3.1 of the standards-sync-audit remediation (plan: docs/topics/standards-sync-audit/PLAN.md, Phase 3 approved 2026-08-19).

What

Deletes the manifest component defs for concurrency-policy, dependabot-policy, and pin-comment-convention, and records the approved Phase 3 plan. All three components have zero target references and zero downstream payloads anywhere in the fleet (verified live); their standards-internal enforcement — the ci.yml jobs, npm lint/test scripts, dependabot roots, and the repin-caller fixture corpus — references the component DIRECTORIES, which stay as producer-internal lint per the audit's locked decision.

Verification

• sync-manifest.sh validate → "Manifest valid: 34 components, 11 targets"; mjs validator green.
• grep -c "concurrency-policy|dependabot-policy|pin-comment-convention" distribution/sync-manifest.yml → 0.
• Note: the post-merge sync run currently fails at ATTEST for an unrelated pre-existing reason — the App installation covers 14 repos vs the manifest's 11 (PR feat(distribution): Phase 4 fleet expansion — three new sync targets #428 aftermath) — so the usual zero-new-PRs post-merge evidence is deferred until the installation set is reconciled.

Related

• Audit topic: docs/topics/standards-sync-audit/ (Phase 3.1)

🤖 Generated with Claude Code

https://claude.ai/code/session_013NhxMDn7vZdbs7Cq32m56M

[claude]

Claude finished @kyle-sexton's task in 2m 58s —— View job

---

Claude finished the code review

• Gather context (PR diff, description, repo instructions)
• Run /review:code-review per custom instructions
• Post inline findings
• Post final summary

Summary

Reviewed both changed files against origin/main:

• distribution/sync-manifest.yml — clean deletion of the three zero-target component defs (concurrency-policy, dependabot-policy, pin-comment-convention). Verified independently: grep confirms zero remaining references to these names anywhere in the manifest, YAML structure around the removed blocks is intact, and no other component's requires: list pointed at them. The PR's claim that these are genuinely zero-target/zero-payload fleet-wide is plausible from the manifest alone (I did not re-verify the "downstream payloads anywhere in the fleet" claim across other repos — that's outside this repo's diff).
• docs/topics/standards-sync-audit/PLAN.md — new Phase 3 planning section (audit trail, not itself sync-behavior-affecting).

1 finding posted inline: the Phase 3.1 "Sanity Check" line (PLAN.md:355) states the expected sync-manifest.sh validate output as "34 components, 8 targets". The manifest actually has 11 targets right now — Phase 4 (#428, three new sync targets) merged to main before this PR, moving the count from 8 → 11. Notably, this PR's own description already states the correct figure ("34 components, 11 targets"), so this looks like the embedded plan text simply wasn't updated to match after Phase 4 landed. Anyone using this doc post-merge to verify the change will hit a mismatch against the documented expectation. Suggested fix included inline.

No other correctness or maintainability issues found in the diff.
· Branch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1df10c8dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.