feat(ariadne): declare the fix categories, and show them beside the actions

The three categories now appear in the deployment next to the action
allowlist, and the monitor prints both at the policy gate so the difference is
visible during a demo rather than asserted: two ids Ariadne may execute on its
own authority, three categories it may only ask Hermes to propose a patch for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/ops/hermes_triage_monitor.py

@@ -302,6 +302,11 @@ def evidence_for(key: str, incident: str = "") -> None:
              "printenv", "ARIADNE_HERMES_ALLOWED_ACTIONS"], limit=2)
         run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--",
              "printenv", "ARIADNE_HERMES_MIN_CONFIDENCE"], limit=2)
+        print(f"  {DIM}a separate setting governs what Hermes may be asked to propose a fix"
+              f" for. It is separate because these become pull requests rather than"
+              f" changes Ariadne makes itself:{RESET}")
+        run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--",
+             "printenv", "ARIADNE_HERMES_FIX_CATEGORIES"], limit=2)
         print()
     elif key == "route":
         if IS_CODE_JOB:

services/maintenance/apps/ariadne-deployment.yaml

@@ -536,6 +536,12 @@ spec:
             # and expensive to read. Below this ceiling an open pull request on
             # a repository is no reason to withhold a fix for a different
             # failure; at it, new proposals wait.
+            # What Hermes may be asked to propose a fix for. Deliberately not
+            # in ARIADNE_HERMES_ALLOWED_ACTIONS: that list gates what Ariadne
+            # executes on its own authority, whereas everything here becomes a
+            # pull request a person reads before anything changes.
+            - name: ARIADNE_HERMES_FIX_CATEGORIES
+              value: lint_violation,undefined_name,failing_assertion
             - name: ARIADNE_HERMES_CODE_MAX_OPEN_PROPOSALS
               value: "64"
             - name: ARIADNE_HERMES_CODE_REPOS