Say that the CodeQL row's question is open, in the parity document (#26)

[iderex]

Closes nothing. Issue #26 stays open. This is a correction to the same document
the required set is assembled from, found while walking that issue's first
clause.

What was wrong

The CodeQL row sent a reader to the section on which contexts arrive for which
of the two strings a required set can hold. That section separates the strings
and then says the question is open for the upload-derived one, at 1593bb1:

git show origin/main:docs/quality-parity.md | sed -n '286,291p'
No pull request from a fork has been opened here. The condition above has two
arms and only the second was walked: the branch measured above is in this
repository, and a read-only token is what the two arms have in common rather
than what makes them one route. `CodeQL` did arrive on that pull request, so
nothing here says whether it arrives from a fork, and the fork clause of #62 is
open for it.

So the section answers the zizmor case and leaves the CodeQL case standing.
The neighbouring row is accurate because a measurement in that same section
decides against the upload name there, and this row was written as though the
same work had been done for both.

What it costs the set

The set #26 assembles is taken from this document, and a name the document sends
somewhere that gives it no verdict is in the same condition as a name with no row
at all: it reads as kept or as dropped with equal justice, and the two readings
produce two different gates. That is the same cost the five names with no verdict
carried at d645d4e, reached by a third route.

How it was found

By following the row's own pointer into the section, rather than by the literal
sweep, which passes here because the literal is present:

git grep -h -oE '\{Name: "[^"]+"' origin/main \
  -- internal/contexts/contexts.go | sed 's/{Name: "//; s/"$//' | sort -u \
  | while read -r n; do
      git grep -q -F "$n" origin/main -- docs/quality-parity.md \
        || echo "no literal in doc: $n"
    done | grep -i codeql ; echo "exit=$?"
exit=1

What this changes

One table row. It names both strings, says that which of the two a required set
can hold is open rather than settled below, and names the issue holding the walk
that would settle it.

What this does not do

It decides nothing. No pull request from a fork has been opened on this board, so
the route that would give the upload name a verdict is still unwalked, and this
change does not walk it. It does not assemble the required set and it does not
touch the ruleset, which is where the done-condition of #26 ends. It moves no
state in internal/contexts/contexts.go: a kept name leaves the
deliberate-absence list by entering the ruleset, and both CodeQL entries
already say so.

The measurements

Run at 1f3643a, the head of this branch:

go test ./internal/prose ./internal/invariants -count=1
ok  	github.com/Flowfin/lab/internal/prose	0.882s
ok  	github.com/Flowfin/lab/internal/invariants	1.005s

go run ./cmd/lab check . | tail -1
0 refused

The means

One row of an existing Markdown document, because what is wrong is a sentence in
that row. No language, runtime or dependency is added.

The reading

There is no second reader on this board tonight, so nothing here has been read by
anybody but its author. The commands above are quoted with their output in place
of one, so every claim in this body can be re-run rather than taken.

Signed-off-by: Nils Lehnen 30603423+iderex@users.noreply.github.com