fix(6854): the locating arguments that only point are declared as references, and the plugin version is minted

The guard caught seven write-tool arguments with a locating name that are not
where the write lands:
- snippet_id on classify_shapes_by_rule and confirm_shape_proposals names the
  canon, not the rows written;
- rule_outcome, rule_misfired and judge_lesson_link record judgments.

REFERENCES lists each one with its reason, and the guard reads it.
READ_PREFIXES names the tool prefixes the fence answers without the server,
and a test holds every write tool to a name outside them.

plugin.json is minted to 2026.11.05.0242 for the PACKAGING.md row.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_write_scope.py

@@ -13,7 +13,7 @@ from quart import g
 
 from grimoire.services import write_scope
 from grimoire.services.write_scope import (
-    LOCATOR_NAMES, LOCATORS, WRITE_TARGETS, check_act, is_issue_filing,
+    LOCATOR_NAMES, LOCATORS, REFERENCES, WRITE_TARGETS, check_act, is_issue_filing,
 )
 
 
@@ -53,14 +53,31 @@ def test_an_argument_that_would_locate_a_write_cannot_be_left_out():
         f"{tool}.{arg}"
         for tool, names in params.items()
         for arg in names & LOCATOR_NAMES
-        if arg not in WRITE_TARGETS[tool]
+        if arg not in WRITE_TARGETS[tool] and arg not in REFERENCES.get(tool, {})
     )
     assert not undeclared, (
         f"write tools take these locating arguments without declaring them in "
-        f"WRITE_TARGETS: {undeclared}"
+        f"WRITE_TARGETS, or saying in REFERENCES why they only point: {undeclared}"
     )
 
 
+def test_a_reference_is_an_argument_the_tool_takes_and_not_also_a_locator():
+    params = _write_tool_params()
+    for tool, refs in REFERENCES.items():
+        for arg in refs:
+            assert arg in params[tool], f"REFERENCES names {tool}.{arg}, which it doesn't take"
+            assert arg not in WRITE_TARGETS[tool], f"{tool}.{arg} is both a locator and a reference"
+
+
+def test_no_write_tool_carries_a_read_prefix():
+    # The fence hook skips the server for these prefixes, so a write named
+    # like a read would pass unchecked.
+    from grimoire.mcp.server import _WRITE_TOOLS
+
+    read_named = sorted(t for t in _WRITE_TOOLS if t.startswith(write_scope.READ_PREFIXES))
+    assert not read_named, f"write tools named like reads: {read_named}"
+
+
 def test_the_locator_scan_sees_the_arguments_it_guards():
     # The guard above passes vacuously if the scan finds no parameters at all.
     params = _write_tool_params()