ci: guard artifact name/description against unsupported claims

[abrignoni]

Ports the claim-language tripwire from the canonical iLEAPP implementation and wires it into the existing Python Lint Check workflow as an added step in the same job.

What it checks

admin/scripts/check_claim_language.py reads each scripts/artifacts/*.py module with ast, evaluates its __artifacts_v2__ literal, and matches the name and description of every entry against a vocabulary of phrasing past audits found to assert what the parsed data does not establish: completeness words, attributions of an act to "the user", certainty words.

Those two fields are examiner-facing. They render into the HTML report, get written into the LAVA manifest, and from there get pasted into examination notes and quoted in court. PR #48 corrected them by hand across the tree; nothing has watched them since.

The check exits 1 on an unallowlisted match, exits 1 on a stale allowlist entry (one matching nothing, which would otherwise outlive the description it was written for and shield the next claim under the same key), and prints NOT CHECKED modules on every run so the coverage hole stays visible.

Triage of the ten first-run hits

Nine are reworded to what the data shows. In each the trigger word came out without losing information:

• robloxCookies, robloxWebView2Cookies, robloxWindowsCookieVault -- "complete <value>" described a single column being emitted untruncated, not a record set.
• discordUsers, discordRecoveredMedia, robloxPlayerLog, wireDesktopLog, wireUsers, signalAttachments -- a leading "All"/"Every" over a set the following clause already scopes ("...in the cached responses this parser decodes", "...except repetitive config-restore entries"). Deleting the word weakens the sentence, so it cannot make it less accurate.

One is allowlisted, with the reason inline: discordCacheRecords's match is inside its own hedge -- "the cache evicts over time, so this index is a partial record of what the client fetched rather than a complete one".

last_update_date bumped on the three entries whose date predated this change.

Known coverage gap

scripts/artifacts/robloxWindows.py builds __artifacts_v2__ through a _windows_artifact() helper that copies and mutates the dict imported from the macOS parser, so it is a call rather than a literal and cannot be read statically. Its four artifacts (robloxWindowsPresence, robloxWindowsNotifications, robloxWindowsGameJoins, robloxWindowsAccount) inherit their descriptions from the macOS modules, which are checked. This is documented by name in the script's docstring and reported as NOT CHECKED on every run.

Verification

• Checker exits 0 on the tree: 33 modules checked, 1 allowlist entry, 1 NOT CHECKED.
• Deliberate break, claim text: injecting "all records the user viewed" into a description exits 1 naming file:artifact:field and the matched terms (all, the user viewed). Reverted.
• Deliberate break, stale allowlist: a bogus entry exits 1 reporting it stale. Reverted.
• py_compile clean on every touched file; workflow YAML parses with the new step in order.
• admin/scripts/lint_changed.py --base-ref origin/main PASS (no new warnings).
• admin/test/: 27 passed.

🤖 Generated with Claude Code