fix: retire the private-repo slug from the shipped scaffold and the vuln-metrics default

[wshallwshall]

The cutover's slug rewrite left three places still naming the retired private vault. Two of them are live defects, not stale strings.

1. The scaffolded provenance gate — ships inside the release

messagefoundry init writes a fail-closed CI gate that runs gh attestation verify --repo ... before installing the pinned engine wheel. It named wshallwshall/MessageFoundry: a repo no adopter can read, and which no longer builds releases. Every project scaffolded from that build gets a supply-chain gate that fails for its own owner.

Every other reference in the repo already names MEFORORG/MessageFoundry — release.yml, README, INSTALL-GUIDE, EARLY-ADOPTER-GUIDE, SUPPLY-CHAIN, MENTAL-MODEL. scaffold.py was the lone outlier, so this corrects it rather than changing policy.

The test pinned the wrong slug, so the broken state was actively enforced — the same shape as the inverted release guard fixed in #7. It now pins the correct value plus the negative (the retired slug must never reappear in a scaffolded gate).

This defect is live in v0.3.1, which was tagged before this branch was ready. See the note at the bottom.

2. vuln-metrics measured the wrong repo

vuln-metrics.yml invokes vuln_metrics.py with no --repo, so the argparse default silently decided what the weekly KPI run measured — and it named the private vault. A public GITHUB_TOKEN cannot read that repo's Dependabot PRs, so the seven KPIs were computed over an empty window rather than failing loudly.

Now defaults to $GITHUB_REPOSITORY, so the job always measures the repo it runs in; the literal is only a local-run fallback. Still stdlib-only (os), which the workflow requires — it runs the script with no install.

3. ci.yml comments (no logic change)

The matrix branch on $GITHUB_REPOSITORY is correct post-cutover, but the comments still described a private-repo/public-mirror split that no longer exists, so it read as a stale guard someone would eventually "fix" in the wrong direction. Restated, and now records why a fork PR cannot wedge the required Windows contexts: a fork PR runs in this repo's context, so it gets the full matrix.

Verification

• ruff format --check / ruff check clean; mypy clean on the changed script.
• Targeted pytest: 28 passed (test_scaffold, test_csv_formula_consistency, test_release_pipeline), plus the three suites that read ci.yml: 64 passed.
• ci.yml still parses (10 jobs).
• Mutation-tested: reverting the scaffold slug fails test_scaffold.py. The new assertion is not green for free.
• Leak gate ran loaded, not blind: loaded names=7, estate=13, estate_file_scanned=12, site_prefixes=1.

Follow-up for the owner

v0.3.1 shipped with defect 1. A user who scaffolds from 0.3.1 gets a CI gate that fails on the provenance step. Worth deciding whether that warrants a 0.3.2 or just a release note — the workaround is a one-line edit, or setting MEFOR_VERIFY_ENGINE=off.

🤖 Generated with Claude Code