[kellymichels]

What and why

Part of the fleet sweep that evo.ehs#1197, evo.provensheet#121 and
evo.civilcode#55 started. This repository had no workstation path to
remove — every drive path in its README is an instructional example
(C:\tools\zscripts, C:\dev\temp, C:\Users\You), which is exactly what
the public mirror is supposed to contain. So this PR is the check, not a
clean-up.

The publish check already refuses a workspace path with a drive letter and a
backslash. It needed both, so two spellings of the same path went straight
past it:

Shape	Why it matters
WSL's and Git Bash's view of the workspace drive	These are the spellings a pasted bash command carries — which is how a path gets into a published file in the first place. Nobody types a Windows path into a document on purpose.
a Windows profile under a real user name	The old rule only fired when the next segment was the workspace, so a profile path anywhere else was invisible. It names the operator.

Both are now rules in tests/sanitization-patterns.psd1, so the publisher in
the private tree reads them from the same list instead of keeping its own —
the drift that previously made it report "clean" on a tree this suite rejects.

The placeholders stay allowed, and have their own test

README.md and zconfig.example.json both have to show a reader where their
own key lives. A rule that flags the placeholder along with the real thing
does not get tightened later — it gets deleted. So C:\Users\You,
C:\Users\YourUser, Public, Default, Administrator and the generic
User/Username are spared, with three assertions pinning that.

A name is matched only when a single separator follows it, so the doubled
backslashes of a JSON example are not mistaken for one.

How it was tested

• Ran both new rules against every publishable file before adding them:
  nothing matched. Nothing in the repository changes.
• Proved they can fail: planted one of each shape in README.md, watched
  exactly those two tests go red with the file and line, removed them, green
  again.
• Invoke-Pester -Path tests -CI — 314 passed, 1 skipped, 0 failed.
• Invoke-ScriptAnalyzer -Path . -Recurse — 0 errors (142 pre-existing
  warnings, which CI prints and does not gate on).
• python scripts/plaintext_twins.py --check — all five twins in sync.

🤖 Generated with Claude Code

Note on the commits

Two commits, not one. The first swept in testResults.xml — Invoke-Pester -CI writes it into the working tree and it is not in .gitignore — and the
second removes it. Worth one line in .gitignore at some point; left out of
this PR because it is unrelated to the check.