The Bundles section is hand-curated and the prover never maintained it: 88 rows vs 10,000

[lroolle]

scripts/triage.mjs assigns exactly two categories:

const category = d.evidence.endsWith("#frontmatter") ? "skill" : "plugin";

So no row admitted by the committed prover has ever been a bundle. Meanwhile:

• 10,000 rows carry category: plugin with evidence: package.json#dsh.bundle
• 88 rows carry category: bundle — 80 of them on that same evidence

The 88 are from the hand pass that predates the prover. The README section built from them says "npm packages with a dsh.bundle manifest: composition layers a profile boots from", which is a true description of 10,000 entries and the heading over 88 of them.

Found because a contributor put their entry there (#89 / #91) and was right to — that is what the section says it is for. The row is plugin today only because that is what its 10,000 peers are.

Three ways out, none obviously right:

1. Derive it. category: bundle when the evidence is a dsh.bundle manifest, plugin when it is a cordis.patch.yml or a dependency. Honest, and it moves ~10,000 rows and rewrites the README's biggest section.
2. Retire the section. Fold Bundles into the areas and drop the category to skill | plugin, matching what the prover has always produced. Loses a distinction some readers use.
3. Make it mean something else — e.g. hand-picked composition layers — and say so in the heading, which is close to what it is today but currently undocumented.

Whichever it is, the fix includes stating the rule in CONTRIBUTING.md, because right now a contributor reading the README picks the section that matches their repo and the prover silently overrules them.

Not urgent: nothing here is wrong data, just a heading that has drifted from what the machine underneath it produces.