verify-no-work-records: treat decisions/** as documentation and replace the root-only name heuristic with an explicit allowlist

[woksin]

Summary

Amend verify-no-work-records.yml and the inlined rule text so that tracked decision records are documentation, not work records, and replace the root-only name heuristic with an explicit documentation allowlist that also catches the mixed-case PLAN-* / DESIGN-* / REPORT-* files the current regexes miss.

Current behaviour

.github/workflows/verify-no-work-records.yml (one input, extra-allowed, lines 12-16) applies three rules:

1. anything tracked under .ai-work/ (line 39);
2. root-level SCREAMING-CASE .md files matched by ^[A-Z][A-Z0-9_.-]*[A-Z0-9]\.md$ (line 52) unless in the root allowlist at line 43 (README|LICENSE|AGENTS|CLAUDE|GEMINI|CODE_OF_CONDUCT|CONTRIBUTING|SECURITY|CHANGELOG|CREDITS|RESOURCES|BRAND|MESSAGING|PAGES|SITE|PRIVACY_POLICY|ROADMAP|START-HERE|CHRONICLE|COMPATIBILITY|NOTICE|SUPPORT|GOVERNANCE|VERSION, plus extra-allowed at line 47);
3. HANDOVER, PROMPT-*, NEXT-SESSION, SESSION-PROMPT, SESSION[-_]HANDOVER names anywhere (line 61), skipping .ai/* .claude/* .github/* .pi/* .agents/* .ai-work/* (line 58).

Consequences:

• A root DECISIONS.md fails rule 2; decisions/HANDOVER.md fails rule 3; nothing says decisions/** (or Documentation/decisions/**, Knowledge/Decisions/**) is documentation, so a repository adopting a decisions folder has to guess what the gate will accept. The rule text inlined in AGENTS.md:11 ("Knowledge that must outlive the session belongs in the repository's documentation structure through normal review") names no location; the canonical copy in Cratis/AI mentions ADRs, this copy does not.
• Mixed-case root files such as PLAN-workbench-product.md or DESIGN-workbench-*.md are not SCREAMING-CASE (they contain lowercase after the prefix) and match none of rule 3's names, so a planning document with a PLAN- or DESIGN- prefix passes the gate at the root and anywhere below it.
• The shape is a name heuristic with a growing root allowlist; every new legitimate root file needs extra-allowed in every wrapper.

Desired behaviour

• An explicit documentation allowlist by directory: decisions/**, Documentation/**, docs/**, Knowledge/Decisions/** (plus the existing root names) are never work records regardless of case; the rule text gains "a decision log is not a work record; decisions live in decisions/ (or the repository's documented decisions folder)".
• Rule 2 becomes case-insensitive on the prefix classes that name work records (PLAN-, DESIGN-, REPORT-, STATUS-, HANDOVER, PROMPT-, NEXT-SESSION, SESSION-) and applies below the root as well, excluding the documentation allowlist and the existing skip list.
• AGENTS.md re-synced from the canonical rule so the ADR/decision wording is present.

Acceptance

Done when:

• A fixture repository with decisions/D-0001-example.md, Documentation/decisions/0003-kernel-boundary.md and a root DECISIONS.md index passes; the same fixture with PLAN-foo.md at the root, docs/../notes/DESIGN-bar.md outside the allowlist, or decisions/HANDOVER.md fails, each with the offending path printed.
• README.md documents the allowlist and the wrapper inputs.

Verify by:

act -W .github/workflows/verify-no-work-records.yml -j verify   # or the script extracted per the exit-2/self-test issue, run against tests/fixtures/work-records-{clean,dirty}

Mutation proof: add Notes/PLAN-something.md to the clean fixture; the run fails naming it.

Out of scope

Exit codes and --self-test (separate issue in this repository); the shared rule text in Cratis/AI (its own issue); recovering any repository's untracked decisions (their own issues).

Dependencies

Source: AI-Learning F-88 (gate half), F-99. Depends on: D-0001 (where decisions live). Related: the verify-decisions reusable workflow issue and the exit-2/self-test issue in this repository; the rule amendment issue in Cratis/AI.