P3.37: harden recording_ref derivation and widen the doc guard

[franciszver]

Closes #79

Small, surgical hardening round from the focused re-review of PR #78. Three one-line-scoped fixes.

FIX 1 — directory-shaped recording_ref now fails loudly

_recording_ref_for (redteam/agents/documentation.py) previously took parts[-2] unconditionally, so a directory-shaped ref (with or without a trailing slash) silently produced a schema-valid but WRONG pointer:

"evals/recordings/identity-authz-garbage-bearer-token/"  ->  'evals/recordings/recordings/'
"evals/recordings/identity-authz-garbage-bearer-token"   ->  'evals/recordings/recordings/'
"evals/recordings/../secrets/d.json"                     ->  'evals/recordings/secrets/'

Now rejects (raises DocumentationAgentError):

• a ref ending in / (directory-shaped)
• a ref whose last segment lacks a .json suffix
• a ref containing a .. path segment

Does NOT re-anchor on a literal recordings segment or relativise against the repo root — that was PR #78's own fix, deliberately preserved (see the docstring, which explains why: tools/load_test_replay.py's scratch tempdir breaks that invariant). Regression-checked:

$ python tools/load_test_replay.py --iterations 5
exploit_ids = 5
signals     = 0

No regression — 0/3-filed-reports failure mode from re-anchoring does NOT reappear.

FIX 2 — doc guard now catches the 17-char phrasing it was written for

tests/test_ato_evidence_index.py's _NO_RECORDING_REF_CLAIM_RE allowed only 10 chars between "has no" and "recording_ref", missing the original docs/ARCHITECTURE.md:77 phrasing (17 chars: deliberately has no `minimal_repro`/`recording_ref` field). Widened to .{0,40} (matching the carries no branch).

A bare widen produced a false positive against redteam/agents/documentation.py's own section heading ("...has no ``minimal_repro.steps``, and how ## ``recording_ref`` works..."), so both branches now also require field within 10 chars after recording_ref — this matches every real "stale claim" phrasing (which all end in "...recording_ref` field") without matching the heading (which says "works", not "field").

Mutation-tested against all three original (pre-PR-#78) ARCHITECTURE.md phrasings:

• :74-77 (prose summary): now caught (was missed before)
• :182-187 (component list): legitimately out of scope — this location's original text only says "the schema has no minimal_repro field" and never claims recording_ref is absent, so it was never a stale claim
• :318 (AI-use table): still caught (was already caught before, unaffected)

docs/ARCHITECTURE.md restored byte-identical after mutation testing (git status --porcelain clean throughout).

FIX 3 — portable regex anchor in the schema

contracts/v1/vuln_report.schema.json's recording_ref pattern used \Z, correct under Python's re (which jsonschema's Draft202012Validator uses) but not portable ECMA-262 (JSON Schema's mandated dialect) — \Z there matches a literal Z, and Go's RE2 rejects it outright. Switched to (?![\s\S]), a portable negative-lookahead with identical semantics in both dialects. Verified byte-for-byte equivalent to \Z under this repo's jsonschema (4.26.0) for every probed case (bare end, trailing \n, trailing space, no trailing slash) — a trailing newline is still rejected. Extended the in-schema comment to record the rationale for future editors.

Docs

docs/ATO_EVIDENCE_PACKET.md / docs/DEMO_SCRIPT.md test-count claims updated 389→392 (with sibling checkout) / 283→286 passed (CI shape), for the net +3 tests from FIX 1's red-first suite (tests/test_doc_test_counts.py enforces this). docs/RELEASE_NOTES_v3.0.0.md untouched (open PR #72).

Verification

• Local: 392 passed (was 389 baseline; +3 from FIX 1's tests)
• CI shape: 286 passed, 106 skipped (was 283/106 baseline)
• docs/vuln_reports/*.json (4 files): byte-identical before/after — git diff empty, sha256 unchanged
• Three inline gates run (declutter → sec-audit → deep-review): no BLOCKER/MAJOR findings; one MINOR noted (FIX 2's widened regex has no dedicated regression test, only manual mutation verification — matches pre-existing coverage model, not a regression)

Test plan

• Red-first: 3 new tests for directory-with-slash, directory-without-slash, .. segment (quoted failing output in commit b8f8e3b)
• python -m pytest -q → 392 passed
• python tools/load_test_replay.py --iterations 5 → exploit_ids=5, signals=0 (no regression)
• Mutation-tested all three original ARCHITECTURE.md phrasings; file restored clean
• Verified (?![\s\S]) byte-equivalent to \Z under jsonschema 4.26.0