docs(tend): the org-secret false positive is fixed upstream in 0.1.18

[dormouse-bot]

The running-tend note on the org-level repo-secret-allowlist FAIL told future sessions to "leave the FAIL standing until it's fixed" — but it is fixed, so the instruction now points at a condition that no longer exists. This rewrites the section as history plus the one ruling that outlives the bug (never add those names to secrets.allowed).

The upstream bug (max-sixty/tend#993) was closed 2026-08-16 by max-sixty/tend#994 and shipped in tend 0.1.18. Tonight's sweep confirms it: tend check now reports PASS repo-secret-allowlist, and the only remaining FAIL is credential-environments — the maintainer-action item already tracked in #339.

No regression test: this is a documentation-only change to a skill file, with no code path to exercise.

Verification

tend check on this checkout tonight (tend 0.1.18):

PASS  branch-protection:main
PASS  bot-permission
PASS  environment
PASS  environment-deployments
FAIL  credential-environments — 2 job(s) request `id-token: write` outside any environment (release.yml:build-standalone, release.yml:build-vscode)
PASS  secrets
PASS  claude-auth
PASS  repo-secret-allowlist — All secrets available to workflows are in allowlist (could not check org-level — grant admin:org scope to verify)

Upstream issue state:

$ gh api repos/max-sixty/tend/issues/993 --jq '{state, closed_at}'
{"closed_at":"2026-08-16T03:12:31Z","state":"closed"}

The 0.1.17 → 0.1.18 workflow regeneration that picks up this fix is #380.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	9b1f248
Status:	✅  Deploy successful!
Preview URL:	https://c2a189ac.mouseterm.pages.dev
Branch Preview URL:	https://docs-running-tend-org-secret.mouseterm.pages.dev

View logs