Item 38: Enforce the write-scope conditions and the job enumeration

Answered by the wiki-in-repo round. tests/workflow_scope.py reads the write-scope job enumeration out of AGENTS.md's Security section and enforces three of the four conditions over every workflow, plus both directions of the enumeration's own failure — a write grant absent from the list, and an entry naming a job no workflow defines. Condition 2 is checked only in the form a script can see: that a write-granting job's context is not a required check. Record: prompts/2026-08-16-wiki-in-repo-sync/REPORT.md.