feat: NVIDIA Sr DevOps application, drop cohort caps, fix Workday/decision-log bugs

Scout run 2026-09-04 (36 companies, 778 eligible) plus the NVIDIA package it
surfaced, and the tooling and policy fixes found along the way.

Application
- NVIDIA Senior DevOps Engineer, Zurich (JR2024256): submitted 2026-09-05.
  Evidence Fit 64/100 Stretch, hard gate FAIL x2, channel Weak. Sent on an
  explicit user override with the working model unresolved, so hybrid-vs-onsite
  is a live screening topic. 2pp resume + 1pp cover letter, both validators
  PASS, 0 boxes, 0 Tier 1 findings open.

Policy
- Drop the 7 Core / 2 Adjacent / 1 Stretch cohort caps. They had no derivation
  and were overridden whenever they bound, and the cohort was confounded: it
  tested fit class while holding channel constant at Weak across all six
  applications. Keep the recording, drop the rationing.
- Channel replaces the slot budget as the rationed variable: no application
  goes out cold when a named contact is published and reachable.
- Propagated through shared_ops, session_file_template, cohort_tracker
  (counts, never counts-against-a-target) and application_cohort.json.

Tool fixes
- fetch_workday emitted 404 URLs for every Workday company (NVIDIA, Novartis,
  Equinor): externalPath is site-relative and needs the locale + site prefix.
  6/6 short-form 404, 3/3 long-form 200. 773 dead links repaired across 42
  archived reports.
- find_decision_url silently de-linked decisions on two boards, which is why
  ruled-out roles kept resurfacing as undecided. RUAG rotates its UUID on
  repost; BIS migrated its vacancy URL scheme, orphaning 5 decisions including
  a live application. Fixed as a two-tier match, not a slug key -- slugs
  collide (two live RUAG reqs shared one).

Knowledge base
- claims.json: add Bash / shell scripting, the third canonical gap of this
  shape after Ansible and Linux administration.
- bundle_data_platform: BS-4 was framed as a delivered observability stack over
  what claims.json calls a proof of concept -- the defect the 2026-08-21 sweep
  was told to look for.
- CLAUDE.md and AGENTS.md: correct the RUAG Data Lakehouse shortlist claim,
  which the JD does not support and which both files still asserted.
- resume_template: comment-guard the missing babel/ngerman language block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFb8tTCig5r1KzkQiNXcYt

job_scout/scout.py

@@ -612,7 +612,10 @@ def fetch_workday(args):
                 "id": jid,
                 "title": p.get("title", ""),
                 "location": p.get("locationsText", "") + " " + ext,
-                "url": f"https://{host}{ext}",
+                # externalPath is site-relative ("/job/<loc>/<slug>_<req>"), so it needs the
+                # locale + site prefix. Without it every Workday URL 404s — verified 2026-09-04
+                # on NVIDIA, Novartis and Equinor (4/4 short form 404, long form 200).
+                "url": f"https://{host}/en-US/{site}{ext}",
                 "posted": p.get("postedOn", ""),
                 "description": "",
             })
@@ -1704,6 +1707,10 @@ _JOB_ID_PATTERNS = [
     # Workday: trailing _REQID on the job slug (Roche 202608-120791-1, Novartis REQ-…, NVIDIA JR…).
     # Also collapses the /apply suffix some rows carry and others don't.
     (r"myworkdayjobs\.com$",      r"_([A-Za-z]*[\d-]+\d)(?:/apply)?/?$"),
+    # BIS migrated its vacancy URLs from /careers/vacancies/jrNNNNNN.htm to /vacancy/jrNNNNNN,
+    # orphaning every decision recorded under the old scheme — including the `applied` row for
+    # jr100429. The jr-id is stable across both. (Verified 2026-09-04.)
+    (r"bis\.org$",                r"/(jr\d+)"),
     (r"smartrecruiters\.com$",    r"/(\d{6,})"),
     (r"greenhouse\.io$",          r"/jobs/(\d+)"),
     (r"careers\.cisco\.com$",     r"/job/(\d+)"),
@@ -1788,12 +1795,32 @@ def index_decisions(decisions):
     return idx
 
 
+_RUAG_SLUG = re.compile(r"^https://jobs\.ruag\.ch/offene-stellen/([^/]+)/[0-9a-f-]{36}/?$")
+
+
+def _ruag_slug(url):
+    m = _RUAG_SLUG.match(url.strip())
+    return m.group(1) if m else None
+
+
 def find_decision_url(decisions, url):
     """Existing log URL for the same job, if one is already recorded under a drifted URL."""
     key = _decision_key(url)
     for existing in decisions:
         if _decision_key(existing) == key:
             return existing
+
+    # RUAG regenerates the UUID in /offene-stellen/<slug>/<uuid> when a req is reposted, so the
+    # exact key misses and an already-judged role resurfaces as undecided — this is what happened
+    # to every RUAG rule-out between the 2026-08-31 and 09-04 runs. The slug survives the repost,
+    # but it is NOT unique: RUAG had two live reqs sharing
+    # `flugzeugmechanikerin-technician-mechanical-f-a-18` on 2026-09-04. So the slug is only a
+    # fallback, and only when it is unambiguous in the log — never let one skip decide two reqs.
+    slug = _ruag_slug(url)
+    if slug:
+        matches = [e for e in decisions if _ruag_slug(e) == slug]
+        if len(matches) == 1:
+            return matches[0]
     return None