Lint: scope the private-infra guard to the build and source

The guard exists so a stranger's install is never pointed at the
maintainer's forge — a property of what an install executes and ships
(bootstrap.sh, firstboot.sh, configs/, iso/), not of documentation.
Grep only those paths, so README/docs may link to the canonical forge
(fixes the red master from the build-status badge).

.github/workflows/lint.yml

@@ -52,15 +52,18 @@ jobs:
             echo "::error::an @@BASE@@ placeholder survived substitution"; exit 1
           fi
 
-      - name: No private infrastructure leaked into a public repo
+      - name: No private infrastructure in the build or source
         run: |
           # This repo installs machines. A stranger's install must never be pointed at the
-          # maintainer's forge, and must never be told to clone a repo they cannot read.
-          # Match the real private domains only — `git.example.com` and friends are the
-          # placeholders in site.env.example and are supposed to be there. Exclude this
-          # file, which necessarily contains the very patterns it searches for.
+          # maintainer's forge, and must never be told to clone a repo they cannot read —
+          # so nothing an install executes or ships (the bootstrap, the firstboot chain,
+          # the configs, the ISO tree) may reference the private infrastructure. Docs and
+          # the README are deliberately out of scope: a badge or link there is for humans
+          # reading the repo, not machines running it. Match the real private domains
+          # only — `git.example.com` and friends are the placeholders in site.env.example
+          # and are supposed to be there.
           if git grep -nIE 'onetick\.ninja|arch\.fyi|/mnt/Tank' \
-               -- . ':!.github/workflows/lint.yml' ; then
-            echo "::error::private infrastructure referenced in a public repo"; exit 1
+               -- bootstrap.sh firstboot.sh configs iso ; then
+            echo "::error::private infrastructure referenced in the build or source"; exit 1
           fi
           echo "clean"

CHANGELOG.md

@@ -5,6 +5,12 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning: [S
 
 ## [Unreleased]
 
+### Changed
+- **The private-infrastructure lint guard is scoped to the build and source** (`bootstrap.sh`,
+  `firstboot.sh`, `configs/`, `iso/`) instead of the whole tree. The guarantee it enforces is that
+  nothing an install executes or ships points at the maintainer's infrastructure; docs and the
+  README may now link there (e.g. a build-status badge for the canonical forge's CI).
+
 ### Added
 - **`site.env` — personal provisioning is now opt-in and out of the repo.** The install runs in
   two phases: a generic base (LUKS + btrfs subvolumes + snapper + yay) that works from a fresh