Describe how private_paths actually matches

[kridaydave]

visibility.toml claimed its patterns were "matched by substring against touched paths". That is not what VisibilityPolicy::path_is_private does (src/visibility.rs:120-151), and the false reading is load-bearing: it is the reading that would make the shipped .pem entry catch a certificate.

Measured against the real function with this repo's own private_paths:

path_is_private(      certs/server.pem) = false
path_is_private(            deploy.pem) = false
path_is_private(              prod.pem) = false
path_is_private(    secrets/server.pem) = true
path_is_private(                  .pem) = true

The matcher does whole-segment matching. .pem matches a file literally named .pem, and nothing else.

Comment-only. The docket output is byte-identical before and after, so this carries no behavior delta.

$ diff <(oot adjudicate ... --visibility visibility.toml) <(same, pristine toml)
IDENTICAL_OUTPUT

Not shipped

.pem staying inert is a bug on the export path (store.rs:1130 and store.rs:1830 both gate on path_is_private), and certs/server.pem is published uncloaked. Two ways to close it, both a call the maintainer should make:

• Change the config to *.pem. One line, no code, uses the wildcard the matcher already supports.
• Teach the matcher a suffix rule so a bare .pem means "any file ending in .pem". More useful generally, but it changes the semantics of every existing policy file, and the export security boundary is not a place to make that call unattended.

I did not take either. Written up rather than shipped, per the boundary rule.