Retire the Media Parser Fuzz Gate, Since Its Inputs Are Trusted #549

Summary

Every media file the gate and the normalizer read is the maintainer's own, so under the carried GOVERNANCE.md "Trust Boundaries and Hardening Effort" it is trusted input. Against trusted input the only threat is a maintainer's mistake, and that section rules out building for adversarial shapes. checks/media_parser_fuzz_gate.py tests exactly those shapes, crafted mutations of committed media, and runs on every pull request in .github/actions/validate/action.yml.

The maintainer's ruling while reviewing the resync for #540: Blog follows the fleet rule here. Fuzzing and hardening have cost a lot of session time, tokens, and Actions minutes for little return, since all input is the maintainer's vetted content. They make sense only where the input is untrusted. The new "Trust Boundaries" subsection under OPERATIONS.md "Configuration Layout" records the policy. The gate itself still runs.

Done

The fuzz gate is retired: the script, its tests, its step in the validate action, and every doc that describes it (OPERATIONS.md, README.md, checks/README.md), with the reference sweep a deletion owes. The media gate's own checks for metadata leaks and accidental damage stay. The OPERATIONS.md fuzzer paragraph goes with it, since no fuzzer is left to fail.

🤖 Generated with Claude Code