NA-0686 — split the literal scan into its own infra-literal-scan context, and retire a stale comment

[Tebbens4832]

Addendum to NA-0686 (D-1325), operator-authorized. OBS-C first half only.
Workflow-only change to .github/workflows/ci.yml. No branch-protection change — that is operator-only.

(a) The split

Until now this repository's literal scan reported under the name public-safety, so an operator-infrastructure literal and a leaked private key failed as the same word. At the branch-protection layer the two causes were indistinguishable: a reviewer saw "public-safety failed" and could not tell whether a secret had escaped or a hostname had, without opening the log.

That is the same defect class as ENG-0082 — 401 and 403 collapsing to one marker code — one layer out. Distinct causes get distinct words.

The new job's context name, step names and their order are byte-consistent with qsl-protocol's infra-literal-scan.yml (verified by comparing the parsed step signatures, not by eye), so all four repositories now report this gate under one name and old lane records keep reading true.

⚠ (a.1) Why the scan is deliberately STILL run in public-safety

This is the safe shape, not an oversight, and it is worth reading before approving.

Measured before editing: in this repository public-safety is a REQUIRED context whose entire content is this scan — it has no other duties. So moving the steps out, rather than adding a second job, would have left a required context that never reports. A required context that never reports blocks every pull request indefinitely — the NA-0653 failure.

Walking into that hazard while splitting a context specifically to avoid a different hazard would have been a poor trade. Duplicating a scan that examines 81 files for the length of one transition is cheap; stranding the repository is not.

A needs:-gated aggregate was considered and rejected: a skipped job can count as SUCCESS for a required context in GitHub, which would turn a scan failure into a green public-safety. Fail-open is not an option for this gate.

(b) The stale comment

The note above public-safety read:

⚠ ADVISORY UNTIL BRANCH PROTECTION CHANGES: this repository requires exactly one status context, rust. The two jobs below RUN and REPORT on every PR, but they cannot block a merge until the operator adds them to the required set.

Measured against live branch protection: three contexts are required — advisories, public-safety and rust. Both jobs have been blocking for some time. A comment that understates a gate is worse than no comment, because it invites someone to merge past a red they were told was advisory.

The replacement states the measured truth, and names what is genuinely advisory now: the new infra-literal-scan context, which runs and reports but is not in the required set.

The sequence, written into the workflow so the follow-up is not guesswork

1. this PR merges; infra-literal-scan reports on main at least once;
2. the operator adds infra-literal-scan to the required set and removes public-safety;
3. a later lane deletes the then-redundant job.

Step 2 is deliberately not automated and not this lane's to make.

Evidence

Red-capable by construction: the new job runs on this very PR, so its own report is the evidence that the context exists and gates. Locally before pushing: --mode tree clean (81 files examined) and the selftest 13 checks, 0 failed. Every workflow file re-parsed with yaml.safe_load after editing.

Goals: G4, G1, G5