docs(audits): declare schemaless-node-config.zod.ts in the strictness ledger (#4278)

The strictness-ledger gate requires every new *.zod.ts with z.object sites
under a triaged directory to carry a Class verdict. The new module's four
sites are authorable (the #4045 node-config family, third panel), with the
drift check living in objectui's cross-repo reconciliation test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ki9WjmmSY19koz9hNkeL1P

Author: claude

docs/audits/2026-07-unknown-key-strictness-ledger.md

@@ -165,7 +165,7 @@ tightening (the #4001 "sharing-rule lesson": candidates, not verdicts).
 | `external-catalog.zod.ts` | 4 | wire (p) | |
 | `field-value.zod.ts` / `seed.zod.ts` / `validation.zod.ts` | 1 ea | mixed (p) | |
 
-### `automation/` — 89 sites
+### `automation/` — 93 sites
 
 | File | Sites | Class | Note |
 |---|---|---|---|
@@ -180,6 +180,7 @@ tightening (the #4001 "sharing-rule lesson": candidates, not verdicts).
 | `node-executor.zod.ts` | 4 | wire | executor contract |
 | `io-node-config.zod.ts` | 2 | authorable | `NotifyConfigSchema` / `HttpConfigSchema` (#4045) — the sibling contracts that validate the **open** `config` slot on flow `notify` / `http` nodes. Authored per-node, so the open-slot exemption above does not extend to them; candidate once the executors' own drift is verified |
 | `builtin-node-config.zod.ts` | 8 | authorable | Same family (#4045): the CRUD quartet, `screen`, `map`. Written from what the executors read rather than from the descriptors' `configSchema` literals, and reconciled bidirectionally by `builtin-node-form-zod-ledger.test.ts` — so unlike most rows here, this one already has a drift check of its own. Same candidacy note as `io-node-config` |
+| `schemaless-node-config.zod.ts` | 4 | authorable | Same family, third panel (#4278): `script` / `subflow` / `decision` (+ the decision branch item) — the descriptor-schemaless nodes whose form lives in objectui's hand-written table. Written from the executors; the drift check is objectui's `flow-node-config.spec-reconciliation` test (cross-repo, via the published exports). Contract exports only — nothing parses node config with them yet, so strictness candidacy follows `io-node-config` |
 | `webhook.zod.ts` | 1 | authorable (p) | spec-only (#3461) |
 
 ### `security/` — 20 sites