Name the repositories the flip covers, and the one it must not

[djankov]

Summary

VERSIONING.md §6.1 said "the seven repositories become public". I wrote that this morning in docs#115, and it is now wrong in two directions.

.repo-template was deleted, not flipped

It existed to scaffold a per-component repository — the thing the four-distribution model retired. Publishing an empty template for a layout the project no longer uses is publishing a wrong instruction.

Mirrored to files/archived-repos-backup/ first with its one pull request exported, the same procedure RM-DIST-05 used for the nineteen. fsck clean, 3 commits, 20 mirrors now held.

astro-mine/embargo must stay private — and no document said so

This is the part worth reading. It holds the sealed held-out benchmark seed sets Bench discloses only at evaluation time, which is the anti-gaming property the whole leaderboard rests on.

Publishing it destroys that property permanently, and not in the way a leaked credential does. A disclosed held-out seed cannot be rotated into safety — the value of the secret is precisely that nobody has trained against it. Rotation gives you new seeds; it does not give you back the population of methods that never saw the old ones.

Before this commit the repository was invisible to the spec:

• bench.md described embargoed held-out seeds as a concept without saying where they live;
• $ASTRO_MINE_BENCH_EMBARGO_ROOT appeared only in _eval.py, in no document;
• the string embargo did not occur anywhere in src/docs.

The only place the exclusion was recorded was the repository's own GitHub description — "Stays private after the public flip" — which is not a document anybody reads before flipping an org.

I found it by listing the org after deleting .repo-template, not by reading anything. A "make the repositories public" step executed against the org rather than against a named list would have published it.

What changed

• §6.1 enumerates the six repositories that become public instead of counting them, and states both exclusions with their reasons.
• bench.md names astro-mine/embargo, the env var, and why it stays behind.

Related, not fixed here

The secret scan on .github#9 covered seven repositories: the six flipping plus .repo-template. It did not cover embargo — correctly, since that repo is not being published, but the scan's "all seven repositories" phrasing now means a different seven than the tracker's. Noted on #9 rather than rescanned, because scanning a repo that stays private is not a flip prerequisite.

Test plan

• python3 scripts/check_docs.py — clean, 69 files
• python3 -m unittest discover -s scripts -t scripts — 37 passed
• Org repo list verified post-deletion: 6 flip-bound + embargo
• Backup mirror fsck-clean before deletion, PR and issue JSON exported