burn-down round 2: R-593 papra field copy, R-760 vikunja healthcheck reason, R-594 English allow-list, R-605 refusal exit 3, R-781 onboarding decoy clone, R-806 scheme; stale runner test fixed

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/check-image-resolvable.py

@@ -9,7 +9,8 @@ perfectly well-formed and pointed at nothing (Campaign 7, §6.2). **Silent rot i
 this repo, so nothing in a change-triggered gate would ever notice.
 
 This resolves each unique `image:` pin against its registry with
-`docker manifest inspect <ref>` and exits non-zero listing everything that did not resolve.
+`docker manifest inspect <ref>` and exits non-zero listing everything that did not resolve
+(1 GONE · 2 some pins could not be checked · 3 the harness REFUSED to run, nothing judged — R-605).
 
     python3 scripts/check-image-resolvable.py              # every AVAILABLE app
     python3 scripts/check-image-resolvable.py --all        # include hidden/abandoned apps too
@@ -159,6 +160,12 @@ def check_images(sites: dict[str, list[str]], resolver) -> tuple[list[str], list
     return absent, inconclusive
 
 
+# R-605: "the harness REFUSED to run" (its canary failed, or it found nothing to judge) is exit 3, distinct from exit 2
+# "it ran and some pins could not be decided" (a throttle). Both are never a pass; catalog_gates.py prints them apart,
+# so a summary can say whether the gate ran at all. Pinned by test_check_image_resolvable.py.
+HARNESS_REFUSED = 3
+
+
 def check(root: Path, only: list[str] | None = None, resolver=docker_resolver,
           include_unavailable: bool = False) -> int:
     sites, skipped = collect_images(root, only, include_unavailable)
@@ -172,7 +179,8 @@ def check(root: Path, only: list[str] | None = None, resolver=docker_resolver,
             print("nothing to check — every app in scope is out of circulation")
             return 0
         print(f"ERROR: no images found under {root}/templates/", file=sys.stderr)
-        return 2
+        print("HARNESS REFUSED — nothing was judged")
+        return HARNESS_REFUSED
 
     # Self-test the resolver before trusting a green result: if it says a ref that CANNOT exist
     # resolves, it is broken (or something is intercepting the registry) and a clean run would be a
@@ -180,7 +188,8 @@ def check(root: Path, only: list[str] | None = None, resolver=docker_resolver,
     if resolver(CANARY_REF)[0] == OK:
         print(f"ERROR: resolver returned success for {CANARY_REF} — it is not trustworthy; "
               "refusing to report a result", file=sys.stderr)
-        return 2
+        print("HARNESS REFUSED — the resolver failed its canary; nothing was judged")
+        return HARNESS_REFUSED
 
     print(f"resolving {len(sites)} unique image pin(s)…")
     absent, inconclusive = check_images(sites, resolver)