ADR-015: where a site's own data is allowed to live

ShopDB is a product several sites adopt, developed at one site against that
site's live fleet, so every feature arrives carrying West Jefferson's
hostnames, networks and share paths. A scan of plugins/ and shopdb/ returns 19
site literals, of which about 8 are a shipped default or a hardcode rather than
a comment: a kiosk URL baked into a PowerShell payload a sister site cannot
override, a WJ UNC path as the backup share default, and device.geaerospace.net
shipped as a SETTING DEFAULT - inherited silently by anyone who adopts.

The mechanisms already existed; the rule did not, so each value landed wherever
was convenient. The rule: a setting with a NEUTRAL default first, a
site-namespaced directory second, seed data third. Blank must be a working
state. Fleet-wide vocabulary such as the gea-shopfloor-* imaging types is not
site data and is out of scope - it already has a per-site override.

Enforced by an addition to check-naming-and-style.sh, which CI already runs, in
REPORT-ONLY mode. Making a 19-item backlog a hard gate the day it lands blocks
every unrelated commit until someone clears it; SITE_LITERALS_ENFORCE=1 turns
it into a gate once the listed hardcodes are done. The ADR carries that backlog,
including that the display FQDN domain is defined three times in three files.

scripts/check-naming-and-style.sh

@@ -135,6 +135,41 @@ if [ -d plugins ]; then
     fi
 fi
 
+# ADR-015: one site's data does not belong in product code. A site host, a site
+# FQDN or a site network in plugins/ or shopdb/ ships another site a value it
+# cannot see and did not choose. Use a setting with a NEUTRAL default, a
+# site-namespaced directory (scripts/site_imports/<site>/), or seed data.
+#
+# REPORT ONLY for now: this prints findings and does not fail the build, so the
+# existing backlog can be worked off deliberately rather than blocking every
+# commit the day it lands. Flip SITE_LITERALS_ENFORCE to 1 to make it a gate.
+SITE_LITERALS_ENFORCE=${SITE_LITERALS_ENFORCE:-0}
+
+echo "==> Checking for site-specific literals in product code (ADR-015)..."
+# Deliberately narrow: a real site hostname, a site FQDN, or a site network.
+# Fleet-wide vocabulary (gea-shopfloor-*) is NOT matched - it is overridable
+# through the pctypemap settings and is not one site's data.
+SITE_PATTERNS='tsgwp00525|\.geaerospace\.net|\bwjs\b|West Jefferson|10\.134\.48\.|10\.48\.249\.'
+SITE_HITS=$(grep -rPn "$SITE_PATTERNS" "${EXCLUDES[@]}" \
+    --include='*.py' --include='*.vue' --include='*.js' \
+    plugins/ shopdb/ 2>/dev/null \
+    | grep -v '/tests\?/' \
+    | grep -v 'site_imports/' || true)
+if [ -n "$SITE_HITS" ]; then
+    COUNT=$(echo "$SITE_HITS" | wc -l)
+    if [ "$SITE_LITERALS_ENFORCE" = "1" ]; then
+        echo "FAIL: $COUNT site-specific literal(s) in product code:"
+        echo "$SITE_HITS"
+        echo
+        VIOLATIONS=$((VIOLATIONS + 1))
+    else
+        echo "     $COUNT site-specific literal(s) found (report only, not failing):"
+        echo "$SITE_HITS" | sed 's/^/       /'
+        echo "     See docs/adr/ADR-015-site-specific-configuration.md"
+        echo
+    fi
+fi
+
 if [ "$VIOLATIONS" -gt 0 ]; then
     echo "=================================================="
     echo "$VIOLATIONS naming/style violation(s) found."