fix: the ml artifact was in a second list I never grepped for (4311)

ac70f2a removed the `ml` image but CI went red on six tests:
`tests/test_artifact_identity.py` parametrises over its own
`ARTIFACTS = ("web", "ml", "agent", "extension")`, and every case now hits
the dispatch guard that same commit added.

My miss, and a specific one. I grepped for `fabledcurator-ml` and `ML_PATHS`
and called the survey done — but the artifact is also named as a bare `"ml"`,
which neither pattern finds. Rule 90 (grep pinned tests when changing a
shared symbol) was surfaced to me while I was making the change and I ran a
narrower sweep than it asks for. Lesson #4275 names the shape exactly: an
absence claim is only as good as the search behind it, and a grep that
matched nothing looks identical to a grep that asked the wrong question.

The re-run was done by value, not by name: every occurrence of a bare `ml` in
the repo, then filtering. That distinguishes the two things the token means —
the celery LANE `ml` and the `backend/app/services/ml` package both stay and
account for nearly every hit; only the IMAGE name went. Worth stating in the
test, since the next person to grep will hit the same ambiguity.

Also swept the prose the first pass left describing the old pipeline: "Four
artifacts" (README, ci-requirements), "leaves web and ml alone" (×5 in
build.yml, plus both docs), "CI publishes it alongside the web/ml images"
(agent/README). The run 4896 build-time measurements keep their `ml` number —
that was measured when ml was a real build — with a note saying the name has
since gone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

.forgejo/workflows/build.yml

@@ -277,8 +277,8 @@ jobs:
       # build — no `set -e`, and every derivation falls back to UNAVAILABLE.
       #
       # What to watch across pushes, because this is what step 3 will trust:
-      #   * a push touching only agent/ moves the agent and leaves web and ml
-      #     STILL. If web moves, its path set is too wide.
+      #   * a push touching only agent/ moves the agent and leaves web STILL.
+      #     If web moves, its path set is too wide.
       #   * a push touching only docs moves nothing.
       #   * a push touching the extension moves the extension AND web, since
       #     web bakes in the XPI. If web does not move, its set is too narrow:
@@ -561,8 +561,8 @@ jobs:
       # never be the reason an image does not ship.
       #
       # What it should say:
-      #   * a push touching only agent/ moves the agent and leaves web and ml
-      #     STILL. If web moves, its path set is too wide.
+      #   * a push touching only agent/ moves the agent and leaves web STILL.
+      #     If web moves, its path set is too wide.
       #   * a push touching only docs moves nothing.
       #   * a push touching the extension moves the extension AND web, since
       #     web bakes in the XPI. If web does not move, its set is too narrow:
@@ -709,7 +709,7 @@ jobs:
       # Each artifact pays one rebuild, once.
       #
       # This is what stops a push that touched only `agent/` from rebuilding
-      # web and ml, and a merge to main from rebuilding what dev already built.
+      # web, and a merge to main from rebuilding what dev already built.
       #
       # The failure direction is deliberate. An inspect that errors for ANY
       # reason — network, auth, a registry hiccup — reads as a miss and the
@@ -1665,8 +1665,8 @@ jobs:
       # never be the reason an image does not ship.
       #
       # What it should say:
-      #   * a push touching only agent/ moves the agent and leaves web and ml
-      #     STILL. If web moves, its path set is too wide.
+      #   * a push touching only agent/ moves the agent and leaves web STILL.
+      #     If web moves, its path set is too wide.
       #   * a push touching only docs moves nothing.
       #   * a push touching the extension moves the extension AND web, since
       #     web bakes in the XPI. If web does not move, its set is too narrow:
@@ -1751,7 +1751,7 @@ jobs:
       # Each artifact pays one rebuild, once.
       #
       # This is what stops a push that touched only `agent/` from rebuilding
-      # web and ml, and a merge to main from rebuilding what dev already built.
+      # web, and a merge to main from rebuilding what dev already built.
       #
       # The failure direction is deliberate. An inspect that errors for ANY
       # reason — network, auth, a registry hiccup — reads as a miss and the