fix legend blurbs missed by hardening (SCC UID-range, MachineConfig SSH, readiness) + extend preflight to scan the app JS where legends inline

pilot/assemble-arc.mjs

@@ -182,7 +182,11 @@ const banned = [
   [/two policies renders from one field/, "subject/verb error 'renders from one field'"],
   [/grown-up chart/, "'grown-up chart' (use 'production-grade chart')"],
 ];
-for (const [re, msg] of banned) if (re.test(html)) fail.push(msg);
+// legend blurbs are inlined into the app JS (the SCENES const), so scan both surfaces
+const visible = html + "\n" + app;
+for (const [re, msg] of banned) if (re.test(visible)) fail.push(msg);
+if (/\bnever by SSH\b/.test(visible)) fail.push("obsolete 'never by SSH'");
+if (/random non-root UID/.test(visible)) fail.push("obsolete 'random non-root UID' (also check legends)");
 
 if (fail.length) { console.error("PREFLIGHT FAILED:\n  - " + fail.join("\n  - ")); process.exit(1); }
 console.log(`site build -> ${DIST}: index.html ${(html.length / 1024).toFixed(0)}KB, rev ${BUILD_REV}, preflight OK (${appName})`);

pilot/manifest-orbit.json

@@ -119,7 +119,7 @@
   {
    "name": "scc",
    "title": "SCC",
-   "blurb": "Admission: what a pod may BE. restricted-v2 runs you as a random non-root UID - your image has to cope.",
+   "blurb": "Admission: what a pod may BE. Under the restricted SCCs a workload runs as a non-root UID from the project's allocated range, so the image must cope with an arbitrary UID.",
    "z": 0,
    "points": [
     [
@@ -607,7 +607,7 @@
   {
    "name": "machineconfig",
    "title": "MachineConfig",
-   "blurb": "The OS underneath is immutable - changed by declaration, never by SSH.",
+   "blurb": "Node OS configuration goes through MachineConfig declaratively; ad-hoc SSH changes create drift and are not the intended model.",
    "z": 0,
    "points": [
     [

pilot/manifest-traffic.json

@@ -559,7 +559,7 @@
   {
    "name": "notready",
    "title": "Pod - not ready",
-   "blurb": "Failing readiness: silently removed. That is the feature - and the first place to look.",
+   "blurb": "Failing readiness: removed from the endpoint set for new Service traffic. That is the feature - and the first place to look.",
    "z": 0,
    "points": [
     [