Grant each public path once: drop the duplicated repair block

[gunbai-bot]

publication_placement_gate_passes is still red on main, but for a different reason than before — and that is the point of this PR.

What happened

Eleven post-cutover paths had no grant, so the gate refused. PR #7580 repaired that by appending a repair block of eleven rows. But #7565 and its siblings had already granted those same eleven in place.

Result on main: 45 grant rows for 34 unique paths. The gate walks roster.file_grants and raises FilePublishGrantMarkerRepeated for each repeat, so main swapped a missing-rows refusal for a duplicate-rows refusal rather than going green.

$ grep -c '^  public_file_publish_grant(path:'   # on main
45
$ grep -o '^  public_file_publish_grant(path: "[^"]*"' | sort -u | wc -l
34

The fix

Delete the appended block. Verified by execution on this branch:

• 34 rows, 34 unique paths, uniq -d empty — no duplicate remains.
• Each of the eleven is still granted exactly once.
• added-since-cutover minus granted is empty — no path lost coverage. This is the check that matters: de-duplicating must not re-open the original hole.

Why the note is rewritten rather than deleted

post_cutover_race_repair_note described the block that no longer exists. It now records the part a future repair actually needs: a grant is set membership, not a log entry, so appending a repair is only sound when the paths are known absent — the safe repair reconciles against what the roster already holds. The underlying race (branches cut before the gate landed) is unchanged and still dissolves when the gate becomes a required branch-protection check.

Related PRs that are now obsolete and would re-introduce duplicates

Both of these predate #7580 and add rows that main now already has. Merging either after #7580 puts duplicates back:

• Reconcile publication roster with current main #7579 — the eight CI-heal/workflow paths
• Roster the three source-integration proof-kernel public paths #7582 — the three source-integration proof-kernel paths (mine; I am closing it)

🤖 Generated with Claude Code

[gunbai-bot]

Closing as obsolete — the duplicates are already gone from main.

PR #7558 removed the appended repair block while landing its own rows, so main now reads 36 grant rows for 36 unique paths and uniq -d is empty. That is the same end state this PR was cutting toward, reached first.

Merging this now would be actively wrong rather than merely redundant: this branch deletes the eleven-row repair block, and on current main those eleven paths survive only as their single in-place grants. Applying the deletion would strip the only grant each of them has and re-open the original hole.

Main is still red, but for a new reason again — dag/extdeps/languages/lean/overflow.dag and src/v2/test/claim/lean_overflow_semantics_witness_test.dag merged ungranted via #7550. That is a different two-row gap, handled separately rather than by reviving this branch.

— sent from proud-swift-104