fix(conformance): placeholder-guard-coupling actually RUNS — it was skipping forever

`conformance/tests/l0-static/placeholder-guard-coupling` (R-ENV-02, R-STATE-03) exited 3
SKIPPED on every gate run since it landed, because its check keyed its whole existence on
`bootstrap/standup.sh`. Measured, not assumed: that file has NEVER been on `main` — there is
no deletion commit for it anywhere; it landed only on unmerged prod-standup branches
(`work/prod-standup-campaign`, `prod/*`, `feat/prod-hardening`). It was planned and never
merged, not removed. SKIPPED is not green, and a permanently-skipped incident-derived test is
the quiet version of the failure it was written to prevent.

The skip was also hiding a RED. Run against the real `standup.sh` from
`work/prod-standup-campaign`, the old check FAILED 2 of 34 assertions — false positives from
treating the empty string as placeholder-shaped for knobs cluster-vars authors empty on
purpose (`BACKUP_CREDENTIALS_SUFFIX`, `VELERO_BACKUP_PREFIX`, both `""` on dev and both
documented there as load-bearing). It would have false-blocked the merge landing its own input.

NOT deleted — the hazard is not gone. Split into two halves, one of which needs no guard:

  HALF A (always runs): no environment overlay ships a placeholder-shaped EFFECTIVE
  cluster-vars value; an empty effective value is STATED by the overlay rather than inherited
  in silence; a LOUD base sentinel is explicitly overridden by every overlay. This is the
  2026-09-05 outcome asserted at the source instead of at the guard — if prod's
  S3_BACKUP_ENDPOINT is never a placeholder, velero cannot be pointed at a hostname that does
  not exist. Input surface is `clusters/`, all of it on `main`.

  HALF B (self-activating): the real predicate extracted and executed against those same
  values, the consumer trace, and the mid-string anchoring property.

The check NEVER exits 3 again, and the guard is DISCOVERED by content rather than hardcoded:
any tracked `*.sh` defining `<name>_is_placeholder()` is found, so a guard landing at
`bootstrap/standup.sh` — or moved into a sourceable library, the remedy the check already
recommends — activates HALF B with no edit to the test. Two files defining it is a FAIL. When
no guard exists the gap is printed loudly every run instead of swallowed as a skip.

LOUD vs EMPTY is the correction that makes it honest in both modes: a loud placeholder is
always a defect in an overlay, while `""` is held to the explicitness rule instead — and still
counts as a placeholder for a knob a guard covers, because a `""` case-arm is the guard
author's declaration that empty is not a usable target.

Proof, all reverted: 84 assertions and exit 0 on `main`; prod S3_BACKUP_ENDPOINT set to the
literal `https://TBD-R2-ACCOUNT-ID.r2.cloudflarestorage.com` FAILS (A1); deleting dev's
explicit VELERO_BACKUP_PREFIX op so it inherits `""` FAILS (A2); a LOUD base BULK_NFS_SERVER
with prod's override deleted FAILS 2/86 (A1+A3); and with the real `standup.sh` present,
reverting `s3_is_placeholder` to the `TBD-*` PREFIX glob FAILS 12/110 (B3 anchoring). With the
pristine `standup.sh` the check PASSES at 110 assertions where the old one failed 2 of 34.

L0 layer: 14 checks, 14 PASS, 0 SKIP, 0 FAIL (was 13 PASS / 1 SKIP). Coverage unchanged —
R-ENV-02 and R-STATE-03 both still list this test, 49/51 with the same 2 gaps.

Also:
  * `ci/touched-requirements.sh` — `bootstrap/*` -> R-STATE-03 R-GITOPS-01 is KEPT, its stale
    comment corrected. It claimed standup.sh "carries the placeholder guards", describing a
    file that is not here; R-STATE-03 there is ANTICIPATORY. Deleting the entry would leave the
    change that lands a placeholder guard selected by nothing.
  * `ci/tests/touched-requirements.test.sh` — new path-map section (12 assertions, was 8)
    locking `bootstrap/*` and `clusters/*`, so removing either entry is a test failure rather
    than a silent loss of selection. All three ci/tests pass (12 + 31 + 15).
  * `docs/BULK-NFS-STORAGE.md` §7 — its "nothing in the gate currently refuses a
    placeholder-shaped overlay value" is no longer true; corrected.
  * Scope re-audited: still deliberately requirement-scoped, not whole-repo. Every path that
    can break it attributes a requirement it declares.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/BULK-NFS-STORAGE.md

@@ -252,18 +252,28 @@ so **plex, sonarr, radarr and nextcloud would sit in ContainerCreating on prod.*
 revision that carries these bulk volumes.** Dev renders a working value and is where these manifests
 are meant to be proven first.
 
-### The static guard this convention leans on is missing from `main`
+### The static guard this convention leans on is missing from `main` — but the gate now refuses the value anyway
 
 `bootstrap/standup.sh` — which carries the `*_is_placeholder` guard family — **does not exist on
 `main`** (verified: `git ls-tree main bootstrap/` lists only `README.md`, `flux/`, `gitea/`, `sops/`;
-the file lives on unmerged prod branches). So
-`conformance/tests/l0-static/placeholder-guard-coupling/check.sh` exits **3 SKIPPED**, and **nothing
-in the gate currently refuses a placeholder-shaped overlay value.**
+the file lives on unmerged prod branches, and there is no deletion commit for it anywhere — it never
+landed rather than having been removed).
 
-When `standup.sh` lands, that check's assertions (2) and (3) cover this knob automatically — its
-independent detector's SEED vocabulary already matches `TBD` — **provided** the guard gains an arm
-for `BULK_NFS_SERVER` and a consumer that calls it. Without the arm, assertion (2) is what fails, by
-design.
+**UPDATED 2026-09-13.** This section used to end "so
+`conformance/tests/l0-static/placeholder-guard-coupling/check.sh` exits **3 SKIPPED**, and nothing in
+the gate currently refuses a placeholder-shaped overlay value." That is **no longer true.** That check
+was restructured (see DECISIONS-LOG, branch `fix/placeholder-guard-coupling-unskipped`): it never
+exits 3, and its HALF A screens **every environment overlay's effective cluster-vars value** against
+an independent placeholder detector with no guard required. A `BULK_NFS_SERVER` of
+`TBD-PROD-BULK-NFS-SERVER` in `clusters/prod/` is now a **merge-gate FAIL** — verified by deliberately
+authoring exactly that value and watching the check fail, which is the one hazard on this page that
+CRD validation cannot catch. HALF A also refuses a LOUD base sentinel that an overlay inherits by
+*omitting* its patch op, which is the other way this knob can silently ship wrong.
+
+The guard is now **discovered by content**, not by path, so when `standup.sh` (or its predicate in a
+sourceable library) lands, the coupling half activates with no edit to the test — and it then covers
+this knob **provided** the guard gains an arm for `BULK_NFS_SERVER` and a consumer that calls it.
+Without the arm, HALF A is what holds the line, by design.
 
 ---