chore: delete the excluded rhiza stubs instead of freezing them

[tschm]

Follow-up to #92. Deletes the three paths that PR excluded, rather than leaving them
frozen.

Why deleting, not just excluding

exclude: stops the sync touching a file — it does not remove it. For the two
workflow callers that meant their uses: …@v1.3.4 pin was frozen permanently: no
future sync will ever bump it. "Inert and frozen" is a worse steady state than
"absent", so they go. The exclude: entries stay exactly as they are, and are now
what stops the files coming back.

Verified: re-running scripts/sync.py against v1.4.2 after the deletions reports
"Template unchanged since last sync — nothing to apply", leaves all three files
deleted, and leaves the tree clean. The exclusions hold.

Nothing is lost

Both workflows are opt-in stubs that skip unless a repository variable enables them:

• gh variable list is empty — neither MUTATION_ENABLED nor FUZZING_ENABLED
  is set, so both have only ever skipped.
• Neither is a required status check in .github/rulesets/main-branch-protection.json.
• Re-enabling either was always two steps (set the variable, restore the caller). It
  stays two steps.

make mutation still runs mutmut locally — that task belongs to rhiza-task, not to
the deleted caller.

.github/CONFIG.md goes for the reason it was excluded: it no longer exists upstream
at v1.4.2, and CLAUDE.md and the README are where this repo's contributor guidance
lives. It follows .github/ISSUE_TEMPLATE and .github/DISCUSSION_TEMPLATE (f98755e,
#93).

One documentation fix found on the way

SECURITY.md claimed:

Fuzzing: ClusterFuzzLite exercises Atheris-based fuzz targets on pull requests
and scheduled batch runs

That has never been true in this repo, for two independent reasons: FUZZING_ENABLED
is unset, and the .clusterfuzzlite/ config the reusable workflow requires does not
exist. Removing the caller makes it permanently false, and a security policy that
overstates its own coverage is worse than one that says less — so the bullet is gone.

SECURITY.md is repo-owned (absent from .rhiza/template.lock), so this edit is not
template drift. I did not audit its other bullets; that's a separate pass if you want
one.

Correction to #92's description

#92's body justified restoring the Makefile shim partly by claiming a missing
Makefile would turn the required Pre-commit hooks check red. That was wrong, and
this PR is a good place to record it:

• The v1.4.2 reusable rhiza_ci.yml runs uvx "$RHIZA_TASK" <gate> for every gate,
  fmt included — nothing shells out to make.
• rhiza-hooks v1.2.0 gates update-readme-help on files: ^Makefile$ and
  check-makefile-targets on (^Makefile$|^\.rhiza/.*\.mk$). With no Makefile there
  are no matched files, so both skip — and a skip is a pass.

Restoring the shim was still right, on the other grounds #92 gave: README and
CLAUDE.md both document make test / make fmt / make typecheck, so it keeps the
documented front door working. Ergonomic, not load-bearing for CI.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Removes previously excluded Rhiza “stub” files so they don’t remain permanently frozen (e.g., with outdated reusable-workflow pins), and corrects repo security documentation to avoid overstating fuzzing coverage.

Changes:

• Deleted the two excluded, opt-in Rhiza workflow callers (rhiza_mutation.yml, rhiza_fuzzing.yml) rather than leaving them frozen.
• Deleted the excluded .github/CONFIG.md doc stub that no longer exists upstream.
• Updated SECURITY.md to remove the (previously inaccurate) fuzzing claim.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
SECURITY.md	Removes the fuzzing bullet so the documented security measures match what’s actually enabled/configured in this repo.
.github/workflows/rhiza_mutation.yml	Deletes an excluded Rhiza workflow caller stub to avoid a permanently frozen reusable-workflow pin.
.github/workflows/rhiza_fuzzing.yml	Deletes an excluded Rhiza workflow caller stub to avoid a permanently frozen reusable-workflow pin.
.github/CONFIG.md	Removes a stale, excluded documentation stub that is no longer present upstream.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.