feat(terminology): add fleet scan allowlist and prose gate (CUST-WP-0055 T08)

Extend scan_workstream_terminology.py with allowlist loading, --apply-allowlist,
and --check-prose-gate for regression detection. Commit the T08 exclusion
config and unit tests; mark T01/T03/T08 done and activate the fleet workplan.

tests/test_scan_workstream_terminology.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from tools.scan_workstream_terminology import (
+    DEFAULT_ALLOWLIST_PATH,
+    load_allowlist,
+    path_is_excluded,
+    prose_gate_violations,
+)
+
+
+def test_load_allowlist_reads_fleet_config() -> None:
+    config = load_allowlist(DEFAULT_ALLOWLIST_PATH)
+    assert config["version"] == 1
+    assert "the-custodian" in config["per_repo"]
+
+
+def test_path_is_excluded_for_archived_workplans() -> None:
+    config = load_allowlist(DEFAULT_ALLOWLIST_PATH)
+    assert path_is_excluded("any-repo", "workplans/archived/foo.md", config)
+    assert not path_is_excluded("any-repo", "workplans/CUST-WP-0001.md", config)
+
+
+def test_path_is_excluded_for_state_hub_compat_router() -> None:
+    config = load_allowlist(DEFAULT_ALLOWLIST_PATH)
+    assert path_is_excluded(
+        "state-hub",
+        "api/routers/workstreams.py",
+        config,
+    )
+    assert not path_is_excluded(
+        "state-hub",
+        "dashboard/src/index.md",
+        config,
+    )
+
+
+def test_path_is_excluded_for_whole_repo() -> None:
+    config = load_allowlist(DEFAULT_ALLOWLIST_PATH)
+    assert path_is_excluded("agentic-resources", "README.md", config)
+
+
+def test_prose_gate_violations_detect_user_facing_workstream() -> None:
+    root = Path(__file__).parent.parent
+    config = load_allowlist(DEFAULT_ALLOWLIST_PATH)
+    violations = prose_gate_violations(root, "the-custodian", config)
+    prose_paths = {path for path, _ in violations}
+    assert "canon/standards/workplan-terminology-fleet_v0.1.md" not in prose_paths