ADR-015: stop shipping one site's values, and make the rule a gate

The scanner has been reporting the same count for weeks, which is what a rule
that only prints becomes. It now FAILS the build, and it looks where the leaks
actually were: PowerShell, the installer, the seeds, generated JSON, the
frontend - case-insensitively, across plugins, shopdb, scripts, deploy, tools.
A line that is deliberate declares itself with an ADR-015-OK marker and a
reason, so the claim is visible in review instead of tolerated in silence.

What it found, fixed here:

- The shadow client wrote one site's ShopDB URL into HKLM whenever the registry
  disagreed. At the site it was written for that reads as healing drift;
  anywhere else it overwrites the site's own address on every enforce cycle,
  and the site cannot win because the cycle repeats. The bay's value now wins,
  an explicit -BaseUrl seeds it, and with neither there is nothing honest to
  write, so it says so and skips.
- The kiosk dispatcher fell back to one plant's host when HKLM was unset, so a
  kiosk elsewhere quietly opened a server it has no business reaching. The
  fallback is now this site's site_base_url, baked in at seed time, and the
  dispatcher refuses rather than guessing when neither is set. Its legacy
  shortcut matcher derives the host from that URL instead of naming one.
- The OpenAPI generator hardcoded a production hostname into every spec it
  generated, which then published to a public wiki. The relative mount is the
  only server it can honestly name; a site passes its own by environment.
- Placeholders and examples in the UI and the client help offered real internal
  subnets and a real production URL. They now use documentation ranges.

Both publication gates - the export scrub and the docs publishability test -
carry the site patterns, which neither did. One plant's hostname, FQDN and
internal networks are out of the documentation and the generated specs.

Comments naming the reference site are reworded rather than deleted: the
reasoning is worth keeping, the plant name is not what makes it true.

scripts/check-naming-and-style.sh

@@ -140,21 +140,40 @@ fi
 # cannot see and did not choose. Use a setting with a NEUTRAL default, a
 # site-namespaced directory (scripts/site_imports/<site>/), or seed data.
 #
-# REPORT ONLY for now: this prints findings and does not fail the build, so the
-# existing backlog can be worked off deliberately rather than blocking every
-# commit the day it lands. Flip SITE_LITERALS_ENFORCE to 1 to make it a gate.
-SITE_LITERALS_ENFORCE=${SITE_LITERALS_ENFORCE:-0}
+# ENFORCING. It was report-only while the backlog was worked off, and the hit
+# count then did not move for weeks - a rule that only prints is read as no rule.
+# Set SITE_LITERALS_ENFORCE=0 to drop back to reporting for a local run.
+SITE_LITERALS_ENFORCE=${SITE_LITERALS_ENFORCE:-1}
 
 echo "==> Checking for site-specific literals in product code (ADR-015)..."
-# Deliberately narrow: a real site hostname, a site FQDN, or a site network.
-# Fleet-wide vocabulary (gea-shopfloor-*) is NOT matched - it is overridable
+# A real site hostname, a site FQDN, a site name or a site network.
+#
+# SCOPE. It used to look at .py/.vue/.js under plugins/ and shopdb/ only, and
+# every literal that actually reached a second site was somewhere else: the
+# PowerShell clients, the installer, the seeds, generated JSON. Case-sensitive
+# too, so Tsgwp00525 passed. Both fixed - the scan is only worth having where
+# the leaks are.
+#
+# Fleet-wide vocabulary (gea-shopfloor-*) is NOT matched: it is overridable
 # through the pctypemap settings and is not one site's data.
+#
+# A line may declare itself deliberate with a trailing `ADR-015-OK: <reason>`
+# marker. That is for an organisation-wide default that is genuinely right for
+# every site and configurable anyway - not for "we will fix it later". The
+# marker makes the claim visible in review; silence would not.
 SITE_PATTERNS='tsgwp00525|\.geaerospace\.net|\bwjs\b|West Jefferson|10\.134\.48\.|10\.48\.249\.'
-SITE_HITS=$(grep -rPn "$SITE_PATTERNS" "${EXCLUDES[@]}" \
+SITE_HITS=$(grep -rPni "$SITE_PATTERNS" "${EXCLUDES[@]}" \
     --include='*.py' --include='*.vue' --include='*.js' \
-    plugins/ shopdb/ 2>/dev/null \
+    --include='*.ps1' --include='*.psm1' --include='*.sh' --include='*.iss' \
+    --include='*.json' --include='*.html' \
+    plugins/ shopdb/ scripts/ deploy/ frontend/src/ tools/ 2>/dev/null \
     | grep -v '/tests\?/' \
-    | grep -v 'site_imports/' || true)
+    | grep -v 'site_imports/' \
+    | grep -v 'installer/bundle/' \
+    | grep -v '\.plugins-staged/' \
+    | grep -v 'check-naming-and-style\.sh' \
+    | grep -v 'export-github\.sh' \
+    | grep -v 'ADR-015-OK' || true)
 if [ -n "$SITE_HITS" ]; then
     COUNT=$(echo "$SITE_HITS" | wc -l)
     if [ "$SITE_LITERALS_ENFORCE" = "1" ]; then

scripts/gen_openapi.py

@@ -20,6 +20,23 @@ OUT = os.path.join(REPO, 'docs', 'openapi.json')
 VERBS = ('get', 'post', 'put', 'patch', 'delete', 'head', 'options')
 
 
+def _servers():
+    """Servers block for the spec: the relative mount, plus this site's own URL
+    if one was supplied.
+
+    SHOPDB_PUBLIC_URL is read from the environment rather than stored, because
+    the generated spec is published to a public wiki - a site URL baked into the
+    generator ends up in everyone's documentation, including sites it is wrong
+    for.
+    """
+    servers = []
+    siteurl = (os.environ.get('SHOPDB_PUBLIC_URL') or '').strip().rstrip('/')
+    if siteurl:
+        servers.append({'url': siteurl, 'description': 'this site'})
+    servers.append({'url': '/', 'description': 'relative to the deployed mount'})
+    return servers
+
+
 def _product_version():
     """Read __version__ out of shopdb/__init__.py without importing the app.
 
@@ -94,10 +111,12 @@ def build(surfaces):
                 '`X-API-Key` for collector/managed-token endpoints; public endpoints '
                 'need neither.'),
         },
-        'servers': [
-            {'url': 'https://tsgwp00525.wjs.geaerospace.net/shopdb', 'description': 'WJ prod'},
-            {'url': '/', 'description': 'relative to the deployed mount'},
-        ],
+        # One site's production hostname was hardcoded here, so every generated
+        # spec published it to the public wiki and offered a second site a
+        # server it cannot reach. The relative mount is the only server this
+        # generator can honestly name; a site that wants its own in the spec
+        # sets SHOPDB_PUBLIC_URL when regenerating.
+        'servers': _servers(),
         'components': {'securitySchemes': {
             'bearerAuth': {'type': 'http', 'scheme': 'bearer', 'bearerFormat': 'JWT',
                            'description': 'Login token or a managed Personal Access Token (scoped).'},