docs(P02): complete gitea-scrub-decisions phase (REQ-367, REQ-368, v1.28.2)

---ci---
project: acdl
phase: 2
milestone: v1.29
status: complete
---/ci---

tests/test_rotate_key_workflow.py

@@ -5,7 +5,12 @@ daily. v0.2 scope: the mechanism must *exist* (exists-not-ran); the v0.2
 deploy uses the currently-active key. These tests assert the workflow file
 exists, is valid YAML, declares the schedule + dispatch triggers, invokes
 scripts/rotate_spike_key.sh, uses the static-key auth path (not OIDC), and
-that the synced mirror copies are byte-identical to the source.
+that the GitHub copy matches the workflows-src/ source.
+
+D-232 (v1.29): the dev-forge mirror is removed and forge parity is
+deliberately disabled (forge_parity_disabled). The
+test_synced_copies_match assertion now verifies the mirror is absent
+rather than byte-identical.
 
 This test file is itself synced to the consumer mirror, so it must be
 forge-agnostic (REQ-230): the dev-forge directory name + the forge-mention
@@ -87,11 +92,15 @@ def test_workflow_uses_static_key_auth():
 
 
 def test_synced_copies_match():
-    assert GITHUB.is_file(), f"{GITHUB} missing (run scripts/sync_workflows.py --write)"
-    assert FORGE_MIRROR.is_file(), "mirror copy missing (run scripts/sync_workflows.py --write)"
+    """D-232 (v1.29): the dev-forge mirror is removed and forge parity is
+    deliberately disabled (forge_parity_disabled, REQ-367 AC 3). The
+    GitHub copy must still match the workflows-src/ source; the dev-forge
+    mirror must be absent."""
+    assert GITHUB.is_file(), f"{GITHUB} missing"
+    assert not FORGE_MIRROR.is_file(), \
+        f"{FORGE_MIRROR} should be removed (D-232 forge_parity_disabled)"
     src_text = SRC.read_text()
     assert GITHUB.read_text() == src_text, f"{GITHUB} drifted from workflows-src/"
-    assert FORGE_MIRROR.read_text() == src_text, "mirror drifted from workflows-src/"
 
 
 def test_workflow_is_forge_agnostic():