refactor(hooks): shrink check-executables-allow-sync (finding 2)

Trim the two comment blocks that re-derived ADR-0019's argument in full
(apm's exact-dict-lookup key matching, and why the PyYAML fallback is not
a hard requirement) down to a short summary plus a pointer at ADR-0019,
which already carries that reasoning verbatim. 231 -> 222 lines.

The hook is kept, not deleted, per the audit's own corrected scope: the
"or drop it" option in SIMPLIFICATION-AUDIT.md finding #2 is off the
table because ADR-0019's Consequences section and the script's own
header both call this failure mode silent, and the ADR says a
silent-staleness failure here is strictly worse than the duplication
this repo's other gates catch.

The dual-reader design (PyYAML preferred, hand-rolled shape-scan
fallback) is also kept as-is: it exists specifically so a missing
python3/PyYAML can't silently skip the check or block every push, which
is exactly the loud-failure guarantee this finding must not weaken. No
genuine redundancy was found in the parsing logic, the per-branch
Why/Fix error messages (each tied to a specific test), or the test
matrix (which verifies the two readers agree across every failure mode)
without cutting something load-bearing -- so those are untouched, and
tests/test-check-executables-allow-sync.sh needed no changes since
script behavior and output are byte-identical.

All 23 tests in tests/test-check-executables-allow-sync.sh pass, and
`pre-commit run check-executables-allow-sync --all-files --hook-stage
pre-push` passes against the real repo state.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD

scripts/check-executables-allow-sync.sh

@@ -2,17 +2,11 @@
 set -euo pipefail
 
 # Fails the push when root apm.yml's executables.allow key stops naming
-# kyberforge's actual version.
+# kyberforge's actual version. apm matches that key by exact dict lookup
-#
+# (apm_cli/security/executables.py) — a version bump that misses the key
-# apm gates a package's hooks/ and bin/ on an EXACT dict lookup of
+# update deploys nothing, with no error anywhere. See ADR-0019, "The allow
-# "<package>#<version>" in executables.allow (apm_cli/security/executables.py,
+# key is version-pinned, and that is a live failure mode", for the full
-# `allow_executables.get(package_key)`) — there is no wildcard and no
+# argument; nothing else in the pre-push gate compares these two files.
-# version-less form. So bumping plugins/kyberforge/apm.yml's `version:` without
-# bumping the key in root apm.yml does not error anywhere: the entry simply
-# stops matching, kyberforge's SessionStart hook stops deploying, and the apm
-# install goes quietly stale — the exact failure ADR-0019 records as live and
-# mitigates only with a comment. Nothing else in the pre-push gate compares the
-# two files, which is why this exists.
 #
 # Run from repo root or pass REPO_ROOT as arg.
 
@@ -64,12 +58,9 @@ fi
 #   a<TAB>present|absent              exactly once — is executables.allow a mapping?
 #   k<TAB><allow key>                 zero or more
 #
-# python3 + PyYAML is preferred where importable, because it is a real parser.
+# python3 + PyYAML is preferred where importable; the fallback below is not a
-# It is deliberately NOT a hard requirement: no other hook in this repo's
+# YAML parser, it recognises only the two shapes these manifests use. PyYAML
-# pre-push gate needs PyYAML, and making a version-pin check the one thing that
+# stays optional so a missing pip package can't block every push (ADR-0019).
-# can block every push on a missing pip package is a worse failure than reading
-# two known shapes by hand. The fallback below is not a YAML parser — it
-# recognises exactly the two shapes these manifests use and nothing else.
 
 read_facts_python() {
   python3 - "$ROOT_MANIFEST" "$PLUGIN_MANIFEST" << 'PY'