fix(ci-health): detect incomplete allow-lists, not just missing hyperpolymath/*

[hyperpolymath]

What

detect.sh emitted B-ALLOWLIST only when hyperpolymath/* was absent from patterns_allowed. A selected-mode repo with a partial allow-list — one that has hyperpolymath/* but is missing a needed third-party action — was flagged only B-STARTUPFAIL, which sweep.sh never remediates. Such a repo stays red at startup_failure permanently, with no self-heal path.

This broadens the check to fire B-ALLOWLIST when the allow-list does not cover the full curated superset. The required set mirrors remediate.sh's PUT body exactly (hyperpolymath/* + each action-superset.txt line as owner/repo@*), so a remediate converges the repo to zero-missing and detect stops re-firing (idempotent; extra patterns tolerated). Subsumes the old rule (empty list still fires, 76/76). all-mode repos stay silent.

Concrete case this unblocks

rsr-template-repo — selected, 14 patterns, has hyperpolymath/* but missing gitleaks/gitleaks-action. Previously invisible to remediation; now detected. (This is the repo whose CI blocks PR #146.)

Scope — no overclaim

This closes the incomplete-allow-list detection gap. It does NOT resolve the estate-wide wipe cycle, in which allow-lists are reset to selected+empty after each daily sweep (an off-tree admin allowed_actions=selected hardening flip that drops patterns without repopulating). That source is owner-side and unreachable from this repo — tracked separately.

Note: empty allow-lists were already detected+remediated by the existing tooling; today's 06:32Z #493 run showed 0 real B-ALLOWLIST and the PUT auth lands. So this PR is a robustness fix for the incomplete minority, not the outage cure.

Validation (run, not asserted)

• shellcheck 0.10.0: clean
• Fixture unit tests of the sed/grep coverage pipeline: empty→all, only-hyperpolymath, full→0, full+extra→0, partial→N — all correct
• Live old-vs-new detect.sh:
  • rsr-template-repo: OLD → B-STARTUPFAIL only; NEW → B-ALLOWLIST (missing 64/76, e.g. 8398a7/action-slack@*) + B-STARTUPFAIL
  • chronicles-of-slavia (empty): NEW → B-ALLOWLIST (76/76) — regression-safe
  • TradeUnionist.jl (mode=all): NEW → no B-ALLOWLIST — regression-safe

🤖 Generated with Claude Code