sync: template 1.6.17-1.6.21 (verbatim block) - #22

SYNC-1.6.17-1.6.21 item 1. The fan-out honours DIVERGENCES.md by never
overwriting a byte-owned path, and until now this repo answered it with
prose only — the conservative mention heuristic, which over-flags and
cannot distinguish a byte claim from an explanation.

Audited the prose against the union of the three live specs'
sync-verbatim blocks. Exactly one path carries a byte-level claim:
`.github/dependabot.yml`, which divergence 3 records as ADDING an npm
ecosystem because this repo actually builds a JS bundle. The 1.6.24
rewrite in SYNC-1.6.22-1.6.27's block is a whole-file copy that removes
the pip entry — and would remove npm with it. One entry, listed, with
the cost written down: a byte-owned path is one the fan-out will never
update either, so dependabot changes land here by hand.

The three kit skills and the kit test stay OUT: they are template-owned
here and byte-identical to template HEAD. Two near-misses the heuristic
would have flagged are named as non-entries — the muischeduler
precedent (another fork's file) and the /new-component skill (private
R&D checkout, not the kit's skills/).

Also records the AI-training-open posture as the fleet's recorded
exception with its wire evidence: robots.txt serves zero Disallow lines
and names no AI-bot group; GPTBot/1.2 and ClaudeBot/1.0 both get 200
on / (2026-08-26).

The two kit files in this commit are no-ops against origin/main — the
F3b fan-out already landed those bytes in #22/#23; this checkout was
stale and re-derived them identically (md5-verified).