feat(ruag): submit AI Engineer C5I, and record the Kdo Cy package

RUAG C5I - AI Engineer C5I (Thun, app ID 18027): SUBMITTED 2026-08-27.
Evidence Fit 74/100, fit class Stretch, title-capability hard gate FAIL
(R1 build/operate the AI-LLM platform and R2 in-house LLM/retrieval are
Adjacent, not Direct) - all knowingly accepted under the user's explicit
Phase 0 override. Consumes the cohort's sole Stretch slot: cohort is now
6/10, Stretch 1/1.

Critique ran twice. Round 1 scored the documents 85/100 and raised three
Tier 1 items; Round 2, after the fixes, scores 93/100 with truth and
provenance 24/25 and zero Tier 1 findings. Evidence Fit did not move and
was not allowed to: PP-3 is a personal project and cannot convert an
Adjacent title-capability into a Direct one.

Documents (.tex is the deliverable; PDFs are gitignored):
- resume 2pp/13 bullets, letter 1pp/295 words, both validators PASS
- headline is now the canonical title "Staff Data, Analytics & AI
  Engineer", which puts the req's own word above the fold
- PP-3 added as a Projekte section - the only current Linux/hardening
  evidence, since BS-6 ended Dec 2022
- the letter names the AI-platform gap in one sentence, then connects
  SW-5 to C5I's stated DevSecOps model
- "governte" -> "governance-konforme"; JD term coverage 18/22 -> 22/22
  claimable, with all six gap terms still correctly absent

Two defects found and fixed that the first critique missed:
- the resume never loaded babel, so a German document was hyphenated
  with English patterns (Hal-bleiterfertigung, Tran-skription). Fixed
  with babel[ngerman] plus a Transkription exception; this also cleared
  an overfull box. Check this on every future German package -
  resume_template.tex likely has the same omission.
- IBM AI Engineering had no primary-source record. Certificate read
  directly (IBM via Coursera, 4 Jun 2020, verify 3ZBZFVAL6A34), recorded
  as entry #8; it also proves PyTorch, now evidence: certification.

Also included: the submitted Kdo Cy DevOps Engineer III package, the
Capgemini omit rule promoted into config.md, BW-1 canonicalized in
experience_bundeswehr.md, and a scout.py comment correcting the
telenorgroup slug from "near-empty" to a claimed board serving stale
phantom listings that DEMO_TITLES would not catch.

Compensation, PSP/project eligibility and role level were never resolved
before sending and are now live screening topics.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JMcHCsTKWvVzqyLChF5ckk

job_scout/scout.py

@@ -289,8 +289,28 @@ COMPANIES = [
     # Telenor Norge (Teamtailor) — Nordic telco; Swisscom is the direct domain analogue
     # and Dennis worked in Norway before (Vizrt, Bergen). NOTE: the old Workday tenant
     # telenorgroup.wd3.myworkdayjobs.com is dead (HTTP 422 on /wday/cxs, 2026-07-29) —
-    # Telenor migrated to Teamtailor. Slug telenorgroup is a near-empty group-HQ board;
-    # telenornorway is the real Norway board (redirects to careers.telenor.no).
+    # Telenor migrated to Teamtailor. telenornorway is the real Norway board (redirects
+    # to careers.telenor.no).
+    # TRAP — slug telenorgroup is NOT a "near-empty group-HQ board" as this comment used
+    # to claim (corrected 2026-08-27): it is a claimed board titled "Sandbox: Telenor
+    # Shared Services" serving 18 phantom listings whose newest is 2024-11-11, including
+    # plausible-looking "Lead Software Engineer" / "Frontend Developer - Oslo" roles. None
+    # of its titles hit the DEMO_TITLES fingerprint in fetch_teamtailor(), so that guard
+    # would NOT catch it — do not widen DEMO_TITLES to cover this. That guard is for
+    # *unclaimed* slugs served Teamtailor's demo seed set; this is a claimed board serving
+    # years-stale data, a different failure mode (a newest-item age threshold is the fix,
+    # if one is ever wanted). Never point this entry at telenorgroup.
+    # Sibling Telenor boards probed 2026-08-27, all rejected, do not re-probe:
+    # telenorcyberdefence (3 roles, newest 2025-10-06 — dormant), telenordenmark (4 roles:
+    # retail sales, praktikant, legal student — zero engineering, and it would run under
+    # the default CH/DK policy rather than norway_only, so it is pure noise),
+    # telenoramp / telenormaritime / telenorsatellite / telenorsverige / telenorkystradio /
+    # telenorbusiness (all HTTP 404 — no such board).
+    # THROUGHPUT (measured 2026-08-27): the live board carries 4-5 roles at a time and is
+    # mostly Norwegian-language ops/security. Exactly one relevant role has surfaced —
+    # Platform Engineer, Core Automation (job 7829423, posted 2026-06-01, score 5), first
+    # reported 2026-08-18 and HTTP 410 Gone by 2026-08-27. The feed did NOT silently drop
+    # it; it genuinely closed. Expect roughly one tailorable role per quarter here.
     # CAVEAT: most Telenor Norge postings require Norwegian ("norsk og engelsk") and are
     # Oslo/Trondheim onsite-hybrid — verify both per role before tailoring.
     # Norwegian-language titles/descriptions score ~0 under the English eng keyword