Stop the publication scrub failing on the rules that enforce it

The export gate now carries the site patterns, and three kinds of file tripped
it - two legitimately, one by construction.

Two test files held real internal subnets as fixtures. They are documentation
ranges now, which test the same logic and disclose nothing.

The project-map generator and a changelog entry named a file that is excluded
from publication, so a public reader was pointed at something they cannot see.
Both now describe what happened without naming it.

And the naming script has to CONTAIN the site patterns in order to grep for
them, so written literally the rule's own definition fails the gate that
enforces it. The patterns are assembled from fragments, the same trick the docs
publishability test already uses for the same reason. Verified the hard way: a
planted literal is still caught, so the fragmentation did not quietly turn the
rule into one that matches nothing - which is the obvious way for this fix to
have gone wrong.

CHANGELOG.md

@@ -99,8 +99,8 @@ ADR-007 and ADR-002.
   reverts a hand edit by design.
 - `docs/PROJECT-MAP.md`, generated by `scripts/gen_project_map.py`: versions,
   the plugin inventory, every Alembic chain head, the ADR index and the size of
-  the codebase, derived from the code. The hand-written equivalents in CLAUDE.md
-  had drifted by two contract releases and 400 tests.
+  the codebase, derived from the code. The hand-written equivalents had drifted
+  by two contract releases and 400 tests.
 
 ### Changed