Six Ufw actions still say 'Ubuntu only' in a catalogue Debian now receives

[vladimirrott]

#384 moved ufw out of the Ubuntu-only fence, and #412 makes Debian stable 12+
an eligible host. Six of the eight Ufw* entries in KNOWN_ACTIONS still tell
the planner they are Ubuntu-only, and all eight are in the Debian catalogue.

Measured at f5dffd8 with #412 and #415 applied:

$ # "Ubuntu only" still present in the planner description?
UfwEnable      YES      UfwDisable     YES
UfwAllow       YES      UfwDeny        YES
UfwReset       YES      UfwLimit       YES
UfwStatus      no       UfwDeleteRule  no

UfwStatus and UfwDeleteRule lost the phrase in #415, because that PR touched
them. The other six were never touched and kept it.

Why it matters

The description string is not a comment. propose_plan_tool_def builds the tool
definition from KNOWN_ACTIONS filtered by available_on, so the text reaches
the model. Building both catalogues and diffing them shows all eight are offered
on Debian:

PROBE catalogue total=190 debian=136 ubuntu=160
PROBE ubuntu_has_debian_lacks(24) = [AddPpa, RemovePpa, Snap*×9, Netplan*×4,
  CheckPendingReboot, UbuntuReleaseUpgrade, Pro*×5, LivepatchStatus, MultipassList]

No Ufw* action is in that list. So on a Debian 12 host the planner is handed six
actions it is allowed to use, each described as unusable there. The likely
outcome is a model that declines to plan a firewall change on Debian, or plans
one while contradicting its own catalogue. Neither is a crash, which is why
nothing catches it.

Scope

• Drop "Ubuntu only" from the six descriptions, matching what fix(ufw): expose numbered rules before deletion #415 did for the
  two it touched. ufw is a Debian-family tool, not an Ubuntu-identity one.
• Sweep the rest of KNOWN_ACTIONS for the same staleness rather than fixing
  only the Ufw* prefix. #384 re-partitioned several families and the
  descriptions were not part of that diff.
• The interesting part, and the reason this is not a one-line change: add a test
  that derives the claim from the fence. An action whose description says
  "Ubuntu only" must be in UBUNTU_ONLY_ACTIONS, and one that is in that list
  should say so. That is a mechanical check against the production lists, and it
  is what stops the next re-partitioning from leaving prose behind.

Difficulty

Easy to fix, and the test in the third bullet is what makes it worth doing.
Without it this recurs on the next family change.

[vladimirrott]

@QinXi-ai holding this for you, offered as part of a batch on #417 so it is not three separate asks.

You dropped "Ubuntu only" from UfwStatus and UfwDeleteRule in #415 because you touched them. The other six kept it, and after #412 all eight are in the Debian catalogue. The description text reaches the model, so six actions now describe themselves as unusable on a host where they work.

The one-line edits are not the point; the third scope bullet is. A test that derives the "Ubuntu only" claim from UBUNTU_ONLY_ACTIONS is what stops the next family re-partitioning from leaving the prose behind, which is what happened here.

Take it or leave it, and no is a complete answer.

[QinXi-ai]

I will take this. I am checking all catalogue descriptions against the production fences, including the other families moved by #384, and will add a two-way regression guard. Codex is assisting with implementation and validation.