fix(setup): stop the update skill reporting the dropped lychee domains as drift

[potiuk]

Summary

• setup-isolated-setup-update check 4 still describes the pre-chore(ci): run lychee link-check offline; drop dead sandbox network domains #501 sandbox network defaults: it tells the agent the dogfooded allowedDomains carries eleven wildcard link-target hosts (*.apache.org, *.nist.gov, lychee.cli.rs, …) and that "without these, lychee fails the PR-blocking prek check locally on first run". chore(ci): run lychee link-check offline; drop dead sandbox network domains #501 dropped exactly those hosts and moved the hook to offline = true, so both claims are now false.
• Consequence in practice: a drift report run against current settings reports eleven correctly absent domains as missing defaults, and walks the adopter into re-adding dead allowlist entries. Hit while running the skill against an up-to-date setup. docs/setup/secure-agent-setup.md was updated in chore(ci): run lychee link-check offline; drop dead sandbox network domains #501; this skill was missed.
• The prose now states the post-chore(ci): run lychee link-check offline; drop dead sandbox network domains #501 reality, and a new test asserts it against .claude/settings.json so the two cannot drift apart again.

Type of change

• Skill change (.claude/skills/<name>/) — see test plan for why no eval fixture
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml) — tools/sandbox-lint (test only)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)

How it works

The rewritten bullet pair says three things the old one got wrong: the default allows only *.crates.io + static.rust-lang.org (the hosts prek needs to bootstrap rustup and cargo install lychee); the eleven link-target hosts were dropped when the hook went offline, so their presence is dead weight to report, never their absence as drift; and enableWeakerNetworkIsolation stays for native-TLS CLI tools (gh / gcloud / terraform), not for lychee.

tools/sandbox-lint/tests/test_doc_domain_consistency.py is the guard. It parses both lists straight out of the skill — the kept hosts from the "default allows …" sentence, the dropped ones from the "once sat beside them (…)" parenthetical — and asserts the first set is present in .claude/settings.json and the second is absent. Rewording the bullet stays free; the two phrases are the anchors. The failure mode it closes is the one this PR fixes: settings move, prose does not, and nothing notices.

Test plan

• prek run --all-files passes (32 hooks, exit 0) — including skill-token-count, hence the docs/mode-economics.md row in the diff.
• uv run --project tools/sandbox-lint pytest tools/sandbox-lint/tests/test_doc_domain_consistency.py — 2 passed.
• Guard verified in both directions: parsing yields exactly {*.crates.io, static.rust-lang.org} kept and the eleven dropped hosts; injecting *.nist.gov into the settings set makes test_dropped_domains_are_not_allowed_again fail.
• No eval fixture added. The skill's four eval suites cover runtime routing, snapshot drift, tool freshness and the after-report step; none extracts check 4, and the changed text is a report-what-you-see instruction rather than a classification boundary. The pytest above is the regression test — it catches the actual defect class (prose vs settings divergence), which an eval on fixed fixtures could not.

RFC-AI-0004 compliance

• Sandbox — no new host access; this narrows what the skill tells adopters to allow.
• Conversational + correctable — the skill stays read-only and proposal-only; only the reported verdict changes.

Linked issues

Refs #501.

Notes for reviewers (optional)

• The enableWeakerNetworkIsolation bullet keeps the schema's security warning verbatim; only its rationale changed (it was justified by lychee, which is now offline).
• Anchoring a test on two prose phrases is a trade. The alternative — duplicating the domain lists in the test — would have made the test agree with itself rather than with the doc, which is the failure this PR is about.

🤖 Generated with Claude Code