fix(621): close a depth blind spot in the record-wing scan

Adversarial self-review: the archive side used `glob("*/*.md")` while records used
rglob. Both exempt the top-level stripped legacy files correctly, but the one-level
glob would ALSO skip anything nested deeper, letting a record at
archive/<area>/<sub>/x.md escape the check entirely.

A path silently escaping the scan is precisely the failure mode this guard exists to
close, so the exemption is now expressed as the actual condition — "directly in
archive/" — rather than a glob shape that happens to match today's layout.

Test added and mutation-verified: reverting to the one-level glob turns it red.
120 passed.

Refs #621

scripts/tests/test_decisions_validate.py

@@ -818,3 +818,19 @@ def test_real_repo_record_wings_are_all_parseable():
     files = dv.record_wing_files()
     assert len(files) > 100, f"record wings look empty ({len(files)} files) — check is vacuous"
     assert dv.record_wing_faults() == []
+
+
+def test_wing_faults_sees_a_DEEPER_nested_archive_record(tmp_path):
+    """A one-level `archive/*/*.md` glob would exempt the top-level stripped files correctly but
+    silently skip anything nested deeper — a path escaping the check, which is the very failure
+    mode this guard exists to close. The exemption must be 'directly in archive/', not 'exactly
+    one level down'."""
+    records, archive = _wing(tmp_path)
+    (records / "ci" / "good.md").write_text(_GOOD)
+    (archive / "api.md").write_text("# api\n\n## Records formerly in this file\n")   # still exempt
+    deep = archive / "ci" / "sub"
+    deep.mkdir(parents=True)
+    (deep / "broken.md").write_text("# not a record\n")
+
+    faults = dv.record_wing_faults(records, archive)
+    assert len(faults) == 1 and "broken.md" in faults[0], faults