fix: leave vale to the governance contract as well

The contract resolves vale through mise, which fronts aqua's registry of
errata-ai's own release archives, so the pin is portable and a copy
installed here is a second version to drift from it. The recipe keeps
shellcheck alone: the ci.sh scripts that call it are project-owned, name
it directly, and pin nothing, so no resolver stands behind it.

Author: repentsinner

SPEC.md

@@ -516,23 +516,22 @@ skips already-installed Flatpaks, and reassembles the userbox with
 
 ### Lint gates reachable on PATH §spec:lint-gates-on-path
 
-`setup-user` installs `shellcheck` and `vale` into `~/.local/bin`.
+`setup-user` installs `shellcheck` into `~/.local/bin`.
 
 Rationale: project `ci.sh` scripts and the governance skills guard these
 tools with `command -v` so a machine without them still runs. The guard
 skips silently, so a local run reports success where the remote gate
 would fail. Installing them makes a local check mean what it appears to
 mean.
 
-No markdown linter is installed. The governance contract pins one and
-resolves it through `uvx`, so a copy installed here would be a second
-version to drift from the pin rather than a convenience.
+Neither `vale` nor a markdown linter is installed. The governance
+contract pins both and resolves them itself — `vale` through `mise`,
+which fronts aqua's registry of errata-ai's own release archives, and
+the markdown linter through `uvx`. A copy installed here is a second
+version to drift from that pin rather than a convenience.
 
-`vale` is installed because nothing resolves it on demand: no registry
-ships it, and the PyPI package is a third-party repackage. The version
-here tracks upstream while a consuming project's CI may pin an older
-one, so the two can disagree; the contract script reports the version it
-ran for that reason.
+`shellcheck` has no such resolver: the `ci.sh` scripts that call it are
+project-owned, name it directly, and pin nothing.
 
 ### Systemd user unit for auto-assembly (chezmoi) §spec:userbox-auto-assembly
 

build_files/tilefin.just

@@ -95,27 +95,23 @@ setup-user image="":
             echo "  chezmoi..."
             sh -c "$(curl -fsLS get.chezmoi.io)" -- -b "$HOME/.local/bin"
         fi
-        # Lint gates. Project ci.sh scripts and the symphonize skills guard
-        # these with `command -v`, so an absent tool is skipped in silence and
-        # a local run reports success the remote gate would not
-        # (§spec:lint-gates-on-path).
+        # shellcheck only. Project ci.sh scripts call it by name and guard it
+        # with `command -v`, so an absent copy is skipped in silence and a
+        # local run reports a success the remote gate would not
+        # (§spec:lint-gates-on-path). Nothing resolves it on demand for them.
+        #
+        # vale and the markdown linter are deliberately absent: the governance
+        # contract pins both and resolves them itself, through mise and uvx. A
+        # copy installed here is a second version to drift from that pin, not
+        # a convenience.
         if echo "$NATIVE_TOOLS" | grep -qx "lint gates"; then
-            echo "  lint gates (shellcheck, vale)..."
-            # Upstream release binaries. The PyPI repackages of shellcheck and
-            # vale are third-party; upstream is one trust hop fewer.
+            echo "  lint gates (shellcheck)..."
+            # Upstream release binary; the PyPI repackage is third-party.
             SC_URL=$(curl -fsSL https://api.github.com/repos/koalaman/shellcheck/releases/latest \
                 | grep -oE 'https://[^"]*linux\.x86_64\.tar\.xz' | head -1)
             curl -fsSL "$SC_URL" | tar xJ -C /tmp
             install -Dm755 /tmp/shellcheck-*/shellcheck "$HOME/.local/bin/shellcheck"
             rm -rf /tmp/shellcheck-*
-            VALE_URL=$(curl -fsSL https://api.github.com/repos/errata-ai/vale/releases/latest \
-                | grep -oE 'https://[^"]*Linux_64-bit\.tar\.gz' | head -1)
-            curl -fsSL "$VALE_URL" | tar xz -C /tmp vale
-            install -Dm755 /tmp/vale "$HOME/.local/bin/vale"
-            rm -f /tmp/vale
-            # No markdown linter here on purpose: the governance contract pins
-            # one and resolves it through uvx, so a copy installed per-machine
-            # would only be a second version to drift.
         fi
     fi