feat: NVIDIA Sr DevOps application, drop cohort caps, fix Workday/decision-log bugs

Scout run 2026-09-04 (36 companies, 778 eligible) plus the NVIDIA package it
surfaced, and the tooling and policy fixes found along the way.

Application
- NVIDIA Senior DevOps Engineer, Zurich (JR2024256): submitted 2026-09-05.
  Evidence Fit 64/100 Stretch, hard gate FAIL x2, channel Weak. Sent on an
  explicit user override with the working model unresolved, so hybrid-vs-onsite
  is a live screening topic. 2pp resume + 1pp cover letter, both validators
  PASS, 0 boxes, 0 Tier 1 findings open.

Policy
- Drop the 7 Core / 2 Adjacent / 1 Stretch cohort caps. They had no derivation
  and were overridden whenever they bound, and the cohort was confounded: it
  tested fit class while holding channel constant at Weak across all six
  applications. Keep the recording, drop the rationing.
- Channel replaces the slot budget as the rationed variable: no application
  goes out cold when a named contact is published and reachable.
- Propagated through shared_ops, session_file_template, cohort_tracker
  (counts, never counts-against-a-target) and application_cohort.json.

Tool fixes
- fetch_workday emitted 404 URLs for every Workday company (NVIDIA, Novartis,
  Equinor): externalPath is site-relative and needs the locale + site prefix.
  6/6 short-form 404, 3/3 long-form 200. 773 dead links repaired across 42
  archived reports.
- find_decision_url silently de-linked decisions on two boards, which is why
  ruled-out roles kept resurfacing as undecided. RUAG rotates its UUID on
  repost; BIS migrated its vacancy URL scheme, orphaning 5 decisions including
  a live application. Fixed as a two-tier match, not a slug key -- slugs
  collide (two live RUAG reqs shared one).

Knowledge base
- claims.json: add Bash / shell scripting, the third canonical gap of this
  shape after Ansible and Linux administration.
- bundle_data_platform: BS-4 was framed as a delivered observability stack over
  what claims.json calls a proof of concept -- the defect the 2026-08-21 sweep
  was told to look for.
- CLAUDE.md and AGENTS.md: correct the RUAG Data Lakehouse shortlist claim,
  which the JD does not support and which both files still asserted.
- resume_template: comment-guard the missing babel/ngerman language block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFb8tTCig5r1KzkQiNXcYt

resume_builder/canonical/claims.json

@@ -563,6 +563,12 @@
       "output": "allowed",
       "note": "User-confirmed 2026-08-27 and previously ABSENT from claims.json entirely. Professional: at Bosch (2020-2022) Linux servers carried everything - ML platform, Docker hosts, backend services, Ansible control - and he administered and automated them (see BS-6). Personal and current: a self-hosted Debian server he has run and hardened for ~10 years (see PP-3). Hardening and security configuration evidence leans on the personal side; say so rather than implying an employer mandate. Does NOT license claiming datacenter/physical infrastructure work, which remains a genuine gap."
     },
+    {
+      "name": "Bash / shell scripting",
+      "evidence": "production-historical-and-personal-current",
+      "output": "allowed",
+      "note": "User-confirmed 2026-09-05 and previously ABSENT from claims.json entirely - the third gap of this shape after Ansible and Linux administration (both 2026-08-27). Evidence basis is the same as Linux administration: professional at Bosch 2020-2022 administering and automating the Linux server estate and the Ansible control path (BS-6), and personal and current on the self-hosted Debian server run for ~10 years (PP-3). Scope is ordinary operational shell work - scripting, automation glue and system administration. Does NOT license Groovy, which stays unverified and forbidden, and does NOT license any claim of systems-programming or kernel-level work."
+    },
     {
       "name": "Docker",
       "evidence": "production-current-and-historical",