check bare paths in scripts/, and record why one file has no .sh

Two answers to "add .sh to sh files". Exactly one file lacks the suffix:
scripts/hooks/pre-commit. git locates a hook by exact filename, so renaming it
would leave a gate that looks present and does nothing — verified in a throwaway
repository, where hooks/pre-commit printed and hooks/pre-commit.sh was ignored
while the commit succeeded regardless. The name belongs to git, so the file keeps
it and conventions.md now states the exception rather than leaving it as an
inconsistency someone will try to tidy again.

The extension was never the defect anyway. The dangling-path gate had only ever
matched backticked citations, so `git add docs/surface.md` in the hook — an
argument, not a citation — survived the docs/ rename and surfaced as a fatal
inside a commit that otherwise succeeded. That gate now also reads paths in
scripts/ unquoted, which is the check that would have caught it.

Proven both ways: restoring the exact bug fails the gate with "reference to a
path that does not exist: docs/surface.md", and a working tree passes. The first
attempt did not catch it — docs had been dropped from the alternation because the
directory no longer exists, which is precisely the class of stale reference worth
failing on, so docs is in the bare pattern on purpose.

Backslashes are stripped before comparing, so a path written as a regex —
\.claude/settings\.json — is checked as the file it means rather than flagged as
the file it is not. Prose is still checked only inside backticks: a sentence
saying "under harness/" makes a point no filesystem can verify, while a script
naming a path either has it right or is broken.

One gate label changed with it. `pass "harness/HARNESS.md coupling"` read fine
while the directory was docs/ and now parses as a filename, which the new check
duly flagged; it is "harness and HARNESS.md move together". No doc cited the old
label.

4 files. No rule or threshold moved — one gate widened, one convention written down.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

HARNESS.md

@@ -256,9 +256,15 @@ that describe it, in the same change.**
   say why. The hook also regenerates `harness/surface.md` and stages it, so a generated file is never
   something you have to remember — and it refuses a commit with unstaged `.go` changes, because what it
   generated describes the working tree rather than what you are committing. It carries **no file
-  extension**, so a repo-wide sweep filtered by `--include='*.sh'` walks straight past it: ADR-0082's
-  rename left it staging a path that no longer existed, and the failure surfaced as a `fatal:` from inside
-  a commit that otherwise succeeded. When renaming anything the gate names, grep without an include filter.
+  extension** because git locates a hook by exact name — the one exception to "shell scripts end in `.sh`"
+  (`conventions.md`), confirmed by renaming it in a throwaway repo and watching a commit succeed with the
+  hook silent. A `.sh` suffix there would leave a gate that looks present and does nothing.
+- **Paths inside `scripts/` are checked whether or not they are quoted.** The dangling-path gate had only
+  ever matched backticked citations, so `git add docs/surface.md` in the hook — an argument, not a
+  citation — survived ADR-0082's rename and surfaced as a `fatal:` inside a commit that otherwise
+  succeeded. Backslashes are stripped first, so a path written as a regex is compared as the file it
+  means. Prose is still checked only in backticks: a sentence saying "under `harness/`" is making a point
+  a filesystem cannot check, while a script naming a path either has it right or is broken.
 - `harness/decisions.md` registers every ADR number ever used, entries and withdrawals alike, so a citation
   can resolve to a decision or to a deferral but never to nothing.
 - `./scripts/verify.sh --list` names every gate that exists. A doc claiming enforcement is checkable