Record the reading that the install address answers

[iderex]

Closes #133.

The address answers with the catalogue it promises, and nothing in the tree said
so. internal/address.Answered stayed empty, and the merge gate went on refusing
every tracked file that printed the address. That refusal was right while the
address answered 404 and had started refusing a true instruction.

The reading the entry rests on

curl -sS -o /dev/null -w "%{http_code}\n" https://flowfin.dev/manifest.json
200

curl -sS https://flowfin.dev/manifest.json \
  | python -c "import json,sys; d=json.load(sys.stdin); print(len(d),'entry')"
1 entry

curl -sS -o served.json https://flowfin.dev/manifest.json
git show origin/main:docs/manifest.json | cmp - served.json && echo identical
identical

Run 2026-08-23 at 514c771. The third one is what decides it. A holding page, a
redirect and a rewritten error page all answer 200, and a Jellyfin server renders
each of them the way it renders an empty repository, so a status code records
that something is at the address rather than that the catalogue is.

The guard still bites, in both directions

An unrecorded near miss planted in an operator-facing file, on this branch:

printf '\nPaste https://flowfin.dev/prerelease-manifest.json into the repositories list.\n' >> README.md
go run . gate install-address-is-answered

--- FAIL: TestNoTrackedFilePrintsAnUnansweredInstallAddress (0.27s)
    address_test.go:199: an install address is printed that nobody has read:
        README.md:155: https://flowfin.dev/prerelease-manifest.json is printed here and is not recorded as answering, so an operator pasting it gets an empty repository and no error (an install address is printed only once it answers with the file it promises)
gate refused: install-address-is-answered

The recorded address in the same place, which is the direction the entry buys:

printf '\nPaste https://flowfin.dev/manifest.json into the repositories list.\n' >> README.md
go run . gate install-address-is-answered

  install-address-is-answered      passed

Both plants were removed afterwards and README.md is untouched by this change.

The suite was passing for the wrong reason

Three refusal tests read the live list and planted the published address as the
thing nobody had read. They went green together the moment the list took its
entry:

--- FAIL: TestRefusesAnInstallAddressNobodyHasReadYet
    address_test.go:40: a printed install address produced 0 refusals, want 1: []
--- FAIL: TestRefusesANearMissOfThePublishedNameToo
    address_test.go:68: HTTPS://FLOWFIN.DEV/MANIFEST.JSON produced 0 refusals, want 1
--- FAIL: TestWhatMayQuoteTheAddressIsNamedAndSmall
    address_test.go:155: README.md is operator-facing and produced 0 refusals, want 1

That is a suite that stops measuring the refusal on the day an entry lands rather
than on the day the rule changes. Each of the three now pins the list empty for
its own length. TestNoTrackedFilePrintsAnUnansweredInstallAddress, the leg
against the real tree with the real list, is unchanged and is what the two plants
above ran.

The harness check starts doing something

It returned early for as long as the list was empty. On this branch:

go test -tags needs_network ./internal/address/ -run TestEveryRecordedInstallAddressStillAnswers -count=1 -v

answered_test.go:32: 1 recorded install address(es) to read
answered_test.go:73: https://flowfin.dev/manifest.json: 200, 1 plugin(s)
--- PASS

The gate

go run . gate

gate examined 14 of 14 legs.
  build                            passed
  test                             passed
  format                           passed
  editorconfig                     passed
  tests-reach-nothing              passed
  no-hardcoded-names               passed
  site-fetches-nothing-outside     passed
  site-links-resolve               passed
  coverage                         passed
  site-declares-its-language       passed
  install-address-is-answered      passed
  colour-stands-off-every-surface  passed
  page-matches-the-token-file      passed
  pr-hygiene                       passed

What the harness did not say

go run . harness needs-network does not pass in this shell, and two of its
checks are why. Neither is about this change and both say so in their own output:

TestThePublishedManifestIsCurrent: MANIFEST_ADDRESS is unset, so there is no address to read
TestTheDeclaredSetResolvesAgainstTheWorld: api.github.com answered 403 Forbidden for eleven declarations

The first wants an environment variable this shell does not set and the second
wants a credential it does not carry. The harness gates no merge here and runs on
no pull request, so this is disclosed rather than worked around, and what it
leaves unproven is that the whole harness is green on a runner that has both.

What this does not do

It does not print the address anywhere an operator reads. README.md,
SECURITY.md and the served pages are untouched, and they still say installation
is not available yet. Writing the instruction is #55 and is a separate topic.

It also does not add the renewal watch. decisions/manifest-address.md says the
renewal belongs under a watch rather than in somebody's memory, and this change
publishes the address without building one, so the obligation the file names
starts today and nothing here reads a renewal date.

Review

No second person has read this. That is stated rather than implied, and the
evidence above stands in place of a second reader: every claim carries the
command that produced it, including the two that were run to watch the guard go
red.