canon: distinguish sector domains from project identity

tools/validate_repo_classification.py

@@ -163,10 +163,22 @@ def self_test(allowed: dict) -> bool:
             "business_mechanics": ["teleportation"],
         }
     }
+    legacy_project_as_domain = {
+        "repo_classification": {
+            "category": "research",
+            "domain": "custodian",
+        }
+    }
     ge, _ = validate(good, allowed)
     be, _ = validate(bad, allowed)
-    ok = (ge == []) and (len(be) >= 5)
-    print(f"self-test: good_errors={len(ge)} bad_errors={len(be)} -> {'PASS' if ok else 'FAIL'}")
+    le, _ = validate(legacy_project_as_domain, allowed)
+    legacy_rejected = any("`domain` 'custodian' not in allowed domains" in error for error in le)
+    ok = (ge == []) and (len(be) >= 5) and legacy_rejected
+    print(
+        "self-test: "
+        f"good_errors={len(ge)} bad_errors={len(be)} "
+        f"legacy_project_domain_rejected={legacy_rejected} -> {'PASS' if ok else 'FAIL'}"
+    )
     return ok