docs(786): record the parser's measured fail-closed property

`_ROW`'s `[^|]*` Blocks cell means a raw pipe inside it — a code span such as
`grep ... | cut ...` — stops the row matching. An unmatched row is an ABSENT row, which the set
equality reports as a guard job with no entry, so the failure is a loud red rather than a
silently skipped row.

Measured rather than reasoned: injecting a pipe into one Blocks cell reddens
test_the_inventory_covers_exactly_the_guard_JOBS_that_exist naming that job. Recorded because a
regex over a Markdown table invites the opposite assumption, and the next person to widen a cell
should know which way it breaks.

Refs #786

scripts/tests/test_workflow_job_guards.py

@@ -64,6 +64,15 @@ ROLES = frozenset({GUARD, ADVISORY, NONE})
 # role -> the Kind the row must carry. `none` is absent by construction: it takes no row.
 ROLE_KIND = {GUARD: "GUARD", ADVISORY: "ADVISORY"}
 
+# Keyed on the `<workflow>.yml::<job>` shape of the first cell, so this cannot match a row of the
+# file-guard table (or any other) even before `inventory_section()` narrows the text.
+#
+# A MALFORMED ROW FAILS CLOSED, which is the property that makes a regex acceptable here at all.
+# `[^|]*` for the Blocks cell means a raw `|` inside it (a code span such as `grep … | cut …`)
+# stops the row matching — and an unmatched row is an ABSENT row, which the set equality reports as
+# a guard job with no entry. Measured: injecting a pipe into one Blocks cell reddens
+# `test_the_inventory_covers_exactly_the_guard_JOBS_that_exist` naming that job. The failure is a
+# loud red on a correct-looking table, never a silently skipped row.
 _ROW = re.compile(r"^\|\s*`([a-z0-9.-]+\.ya?ml::[A-Za-z0-9_-]+)`\s*\|([^|]*)\|\s*([A-Z]+)\s*\|", re.M)