Stop the publication scrub failing on the rules that enforce it

The export gate now carries the site patterns, and three kinds of file tripped
it - two legitimately, one by construction.

Two test files held real internal subnets as fixtures. They are documentation
ranges now, which test the same logic and disclose nothing.

The project-map generator and a changelog entry named a file that is excluded
from publication, so a public reader was pointed at something they cannot see.
Both now describe what happened without naming it.

And the naming script has to CONTAIN the site patterns in order to grep for
them, so written literally the rule's own definition fails the gate that
enforces it. The patterns are assembled from fragments, the same trick the docs
publishability test already uses for the same reason. Verified the hard way: a
planted literal is still caught, so the fragmentation did not quietly turn the
rule into one that matches nothing - which is the obvious way for this fix to
have gone wrong.

tests/test_plugins/test_geenforce_manifest.py

@@ -125,7 +125,7 @@ def _set_allowlist(app, value):
 def test_ip_allowlist_allows_without_token(client, db, app):
     # An allowlisted caller reaches the manifest with NO token (vault trust).
     _seed_and_publish(app)
-    _set_allowlist(app, '127.0.0.0/8, 10.134.48.0/23')  # test client is 127.0.0.1
+    _set_allowlist(app, '127.0.0.0/8, 192.0.2.0/24')  # test client is 127.0.0.1
     resp = client.get('/api/geenforce/manifest?pctype=gea-shopfloor-cmm')
     assert resp.status_code == 200, resp.data
     assert b'Alpha' in resp.data
@@ -152,9 +152,9 @@ def test_spoofed_forwarded_for_does_not_bypass_allowlist(client, db, app):
     # whose real IP (127.0.0.1) is NOT allowlisted must NOT gain token-less access
     # by forging X-Forwarded-For to an allowlisted address.
     _seed_and_publish(app)
-    _set_allowlist(app, '10.134.48.0/23')  # test client 127.0.0.1 is NOT in it
+    _set_allowlist(app, '192.0.2.0/24')  # test client 127.0.0.1 is NOT in it
     resp = client.get('/api/geenforce/manifest?pctype=gea-shopfloor-cmm',
-                      headers={'X-Forwarded-For': '10.134.48.10'})
+                      headers={'X-Forwarded-For': '192.0.2.10'})
     assert resp.status_code == 401, 'spoofed X-Forwarded-For bypassed the allowlist'