Drain extdeps external-authority anchor allowlist to EMPTY (28 → 0)

[briansrls]

Drain extdeps external-authority anchor allowlist to EMPTY (28 → 0)

Completes the operator-directed drain of dsl/extdeps/external_authority_backfill_pending.txt. Every extdeps module now carries an external_authority_anchor (or is legitimately excluded as test scaffolding); the backfill scaffold is fully dissolved.

Three dispositions for the 28 remaining entries

1. Real external anchor (1): extdeps.cloud.cloud models real AWS (regions, services, SigV4, endpoints) → cites the AWS General Reference, in-lane with the prior 99.

2. Test-scaffolding exemption (9 *.mock_corpus): hermetic test-replay fixtures (PublishedMockCase data) paired with already-anchored real siblings (extdeps.git.mock_corpus ↔ the anchored extdeps.git.git). Excluded from the anchor roster exactly like extdeps.fixture.*, via a .mock_corpus suffix rule on the single host authority. Discriminating test mock_corpus_excluded_but_real_sibling_still_in_roster proves the real siblings stay in-roster — the exclusion is not fail-open.

3. Internal-URI anchor (18 gunbc machinery), per operator §3 ruling: the cache cluster, the Realization machinery, the .dag language modules, and the gunbc/tools/transports/runtime/llm self-reference modules have no external upstream, so per the operator's ruling ("everything here should have some external authority; gunbc can use the repo") they anchor to the gunbc repo. Per-subsystem-dir Https URIs into github.com/gunb-ai/gunbc/tree/main/… (8 distinct, grouping coherent subsystems — the cache cluster shares one authority per §3 single-authority, not 18 identical stamps).

Discrimination preserved (not a rubber-stamp)

The anchor lens is untouched — only anchor declarations were added. Verified green by execution:

• corpus_live_clean_tree_holds / external_authority_live_clean_tree_holds_via_host green with all modules anchored and the empty allowlist;
• the no-anchor control corpus_live_clean_tree_anchor_drop_red still REDs — a module without an anchor is still caught, so the gunbc repo URL is not a fail-open universal pass.

CI note

Touches .rs (slice-1 mock-exemption predicate), so it runs rust_tests. Until #5579 merges, that gate inherits 3 pre-existing main-red tests from #5567's comment-strip (02_parse.dag non-ASCII fixture + 05_emit_rust.dag audit) — not a defect in this PR; clears when #5579 lands.