fix: leave the markdown linter to the governance contract

The contract pins a markdown linter and resolves it through uvx. A copy
installed per-machine is a second version to drift from that pin, not a
convenience, so setup-user no longer installs one.

shellcheck stays: project ci.sh scripts call it directly and nothing
resolves it on demand. vale stays for the same reason — no registry
ships it, and the PyPI package is a third-party repackage. Its version
tracks upstream while a consuming CI may pin an older one, which the
contract script now reports rather than leaving to be discovered.

Author: repentsinner

SPEC.md

@@ -516,21 +516,23 @@ skips already-installed Flatpaks, and reassembles the userbox with
 
 ### Lint gates reachable on PATH §spec:lint-gates-on-path
 
-`setup-user` installs `shellcheck`, `vale` and `rumdl` into
-`~/.local/bin`.
+`setup-user` installs `shellcheck` and `vale` into `~/.local/bin`.
 
 Rationale: project `ci.sh` scripts and the governance skills guard these
 tools with `command -v` so a machine without them still runs. The guard
 skips silently, so a local run reports success where the remote gate
 would fail. Installing them makes a local check mean what it appears to
 mean.
 
-`rumdl` stands in for `markdownlint-cli2`, which requires Node. It reads
-`.markdownlint.json` and `.markdownlint-cli2.jsonc` directly and
-implements the same rule identifiers, but it is not bug-for-bug
-identical: line-length and list-indentation behaviour differ. Where a
-remote gate runs `markdownlint-cli2`, compare both before trusting the
-local result.
+No markdown linter is installed. The governance contract pins one and
+resolves it through `uvx`, so a copy installed here would be a second
+version to drift from the pin rather than a convenience.
+
+`vale` is installed because nothing resolves it on demand: no registry
+ships it, and the PyPI package is a third-party repackage. The version
+here tracks upstream while a consuming project's CI may pin an older
+one, so the two can disagree; the contract script reports the version it
+ran for that reason.
 
 ### Systemd user unit for auto-assembly (chezmoi) §spec:userbox-auto-assembly
 

build_files/tilefin.just

@@ -100,7 +100,7 @@ setup-user image="":
         # a local run reports success the remote gate would not
         # (§spec:lint-gates-on-path).
         if echo "$NATIVE_TOOLS" | grep -qx "lint gates"; then
-            echo "  lint gates (shellcheck, vale, rumdl)..."
+            echo "  lint gates (shellcheck, vale)..."
             # Upstream release binaries. The PyPI repackages of shellcheck and
             # vale are third-party; upstream is one trust hop fewer.
             SC_URL=$(curl -fsSL https://api.github.com/repos/koalaman/shellcheck/releases/latest \
@@ -113,9 +113,9 @@ setup-user image="":
             curl -fsSL "$VALE_URL" | tar xz -C /tmp vale
             install -Dm755 /tmp/vale "$HOME/.local/bin/vale"
             rm -f /tmp/vale
-            # rumdl reads markdownlint and markdownlint-cli2 config files and
-            # needs no Node. PyPI is its upstream distribution channel.
-            "$HOME/.local/bin/uv" tool install rumdl
+            # No markdown linter here on purpose: the governance contract pins
+            # one and resolves it through uvx, so a copy installed per-machine
+            # would only be a second version to drift.
         fi
     fi