docs: take two leaks off the public wiki, and say where the files come from

An ACCEPTED ADR ended with a stray tool-call fragment - it said nothing to a
reader and everything about how the document was produced, which is not what a
decision record is for. And the cutover playbook carried a real internal IP in a
file otherwise correctly scrubbed to documentation ranges. Both were published.

The publishability gate now catches all three shapes, so the next one fails a
build instead of reaching the wiki.

The adoption guide also told a site to copy two files that ship from nowhere:
the asset reporter and EventSaver are both on the reference site's imaging
share, not in this repository, and the guide never said so - it could not be
followed as written. It now states, per artifact, where each comes from, which
of them are pending a move into this repository, and that EventSaver can be
rebuilt from its one source file rather than taken on trust as a binary.

docs/ADOPTING-AT-ANOTHER-SITE.md

@@ -13,6 +13,22 @@ API key, and which PCs it runs on - and all three are inputs, not code.
 > (every example below does) until that default is removed. See
 > [ADR-015](adr/ADR-015-site-specific-configuration.md).
 
+## Where these files come from
+
+The commands below copy files. This is where each one is obtained, because they
+do not all ship from the same place and two of them are not in this repository
+at all yet.
+
+| Artifact | Where it is today |
+|---|---|
+| GE-Enforce client (`Install-GEEnforce.ps1`, `Invoke-ShopdbEnforce.ps1`, `ShopdbEnforceClient.psm1`) | This repository, `plugins/geenforce/client/`. Present on any installed server under the install directory. |
+| `Report-AssetToShopDB.ps1` | **Not in this repository.** It lives on the reference site's imaging share and is provided on request. It is planned to move to `plugins/computers/client/` so it versions with the collector contract it implements. |
+| EventSaver (`EventSaver.scr`, `EventSaver.ini`, `EventSaver.cs`) | **Not in this repository.** Provided on request; the source is a single C# file that builds with the in-box .NET Framework compiler, so a site can rebuild it rather than trust a binary. See [EVENTSAVER.md](EVENTSAVER.md). |
+
+Ask the maintainers for the two that are not here. A site that would rather not
+run a binary it cannot rebuild should take EventSaver's source and compile it
+locally - the build needs no SDK and is one command.
+
 ---
 
 ## Part 1: the asset reporter

docs/adr/ADR-010-frontend-plugin-hooks.md

@@ -316,5 +316,3 @@ sites.
 - docs/CONTRACT-STABILITY.md (the expected-churn line this ADR answers)
 - shopdb/plugins/base.py (existing declarative hooks this pattern extends)
 - shopdb/core/api/dashboard.py, shopdb/core/api/reports.py (consumer precedent)
-</content>
-</invoke>

docs/geenforce-api-cutover.md

@@ -618,7 +618,7 @@ git pipeline.
 ### Channel 1: backend + frontend (the git .cmd pipeline)
 
 Prod is air-gapped from dev; code moves via a git bundle on the share
-(`\\172.16.9.9\pxe-images\github\shopdb-flask-pub.bundle`) and the .cmd
+(`\\<imaging-share>\github\shopdb-flask-pub.bundle`) and the .cmd
 scripts in the imaging share (`github/`), run on the work PC:
 
 1. `pull-shopdb-bundle.cmd` - fetch the bundle into the local clone

tests/test_docs_publishable.py

@@ -54,6 +54,12 @@ FORBIDDEN = [
     # nor meaningful to any other site reading these pages. Assembled from
     # fragments for the same reason as the terms above.
     ('tsg' + 'wp00525', 'names a production server'),
+    (r'\b' + r'172\.16\.' + r'\d', 'names an internal network'),
+    # A tool-call fragment reached the end of an ACCEPTED ADR and published to
+    # the wiki. It says nothing to a reader and everything about how the
+    # document was produced, which is not what a decision record is for.
+    ('</' + 'invoke>', 'contains a tool-call artifact'),
+    ('</' + 'content>', 'contains a tool-call artifact'),
     (r'\bwjs\.' + r'geaerospace\.net\b', 'names a site FQDN'),
     (r'10\.134\.48\.', 'names an internal network'),
     (r'10\.48\.249\.', 'names an internal network'),