feat(grug): hygiene-watch dead-ref category ships inert - scan_file is called without patterns

[quadseven]

Why

guard/hygiene_watch.py (PR #766, slice #655) advertises four rule categories, but one of them never fires. run_hygiene_watch_for_install calls scan_file(path, text) without the third argument, so dead_patterns takes its () default and scan_dead_refs returns nothing on every file, in every repo, forever.

The deferral was the right call and should not be undone the obvious way. The diff-time linter (workflow_hygiene.py) carries a concrete list of decommissioned cluster paths and host names. Those are one operator's private infrastructure names and this repo is PUBLIC - hardcoding them here would publish them to every reader, and they would be meaningless for any other install regardless. scan_dead_refs taking patterns as an argument is the correct shape; what is missing is a private place for the data to come from.

Why it needs an issue rather than a comment. The logic is tested and looks live. A weekly report listing three categories reads as "the fourth category found nothing", not "the fourth category is disabled" - a silent failure in the reassuring direction, which is the same class the absent archived key test in PR #769 was written to prevent. Nothing in the report, the logs, or the code tells an operator the rule is inert.

Acceptance criteria

• Dead-reference patterns are supplied per repo from a non-public source (repo-config field in the store, or a Secret), never hardcoded in this repository
• run_hygiene_watch_for_install passes those patterns through to scan_file, so the category actually fires
• With patterns configured, a fixture file containing one produces exactly one dead-ref violation end to end, not just in a scan_dead_refs unit test
• While no patterns are configured, the state is VISIBLE rather than silent - the report or the log says the category is unconfigured, so an empty result is never mistaken for a clean result
• Configuring patterns is documented for a third-party install, given the data cannot ship in this repo

Size

Size: S

Dependencies

Refs #655, Refs #766. Related #768 (the same three watch flags have no dashboard control).

Out of scope

• The other three categories (job-timeout, curl-timeout, unpinned-action), which are live and tested.
• Moving workflow_hygiene.py's own pattern list, which lives in a private repo and is fine where it is.
• The dashboard-toggle gap, tracked in [grug] 12 of 14 repo-config flags have no dashboard control - six personas cannot be toggled at all #768.