Work-record guard should skip vendored third-party trees #215

The shared work-record guard (.github/scripts/verify-no-work-records.mjs) applies its name-based rules to vendored third-party files. Cratis/SEO's push runs fail because 12 files under vendor/claude-seo/ are named prompt-*.md and match the session rule (Cratis/SEO#74).

Change

• The name-based rules (root-document, session, work-record-shape) skip any path with a segment named exactly vendor/. The .ai-work/ and .pi/ runtime rules still apply, and the case handling of prompt- is unchanged elsewhere.
• Self-test: vendored files pass; a non-vendored prompt-x.md and a Vendor/ (not exactly vendor) path are still caught.
• Update the commit and SHA-256 pins of the guard in verify-no-work-records.yml and verify-pull-request-policy.yml.

Acceptance

Cratis/SEO's next Verify Pull Request Policy push run is green.

Status

State: Done — Merged in #216 (f4832ab); SEO push run green on re-run.
Branch: stage-422-atomic-execution
Scope: vendor/ skip in work-record guard name rules + self-test + pin update; then verify SEO push run green and close SEO#74.
Delivered: - #216
Remaining: To be confirmed.
Follow-ups: None.