Adversarial self-review: the archive side used `glob("*/*.md")` while records used
rglob. Both exempt the top-level stripped legacy files correctly, but the one-level
glob would ALSO skip anything nested deeper, letting a record at
archive/<area>/<sub>/x.md escape the check entirely.
A path silently escaping the scan is precisely the failure mode this guard exists to
close, so the exemption is now expressed as the actual condition — "directly in
archive/" — rather than a glob shape that happens to match today's layout.
Test added and mutation-verified: reverting to the one-level glob turns it red.
120 passed.
Refs #621
timothy
b42df5f15f