the detector stops reporting itself

`vendormark` refuses a site-generator vendor's branding anywhere in a tree, and
it has been failing on this one since it was written — because bin/vendormark is
where the signatures are DEFINED. Its own CONTENT_SIG literal matches
CONTENT_SIG, and its test writes the very script tags it exists to catch. Every
build of hanzoai/ci went red at "Structural invariants (the repo agrees with
itself)" on a repo that carries no vendor branding at all.

That is worse than a missing gate. A gate that cannot pass over a correct tree
is one people learn to scroll past, and this one had been red on main long
enough for the habit to form — the last several runs before this all failed at
the same step, and none of them was about vendor branding.

The tool already had the right escape hatch, and nothing had used it. This
declares the two files by PATH rather than by pattern, so the exception cannot
quietly widen to cover a page that really does ship someone else's mark. The
other three invariants — ignoretracked, modsize, conflictmarkers — were passing
and are unchanged.

.vendormark-allow

@@ -0,0 +1,11 @@
+# The detector and its test are where the signatures are DEFINED, so they match
+# themselves. Nothing else may carry a vendor mark, and that is the point: this
+# file names two paths, not a pattern, so an allowlist entry cannot quietly grow
+# to cover a page that really does ship someone else's branding.
+#
+# Left unlisted, `vendormark .` failed on this repo for every build — it read its
+# own CONTENT_SIG literal and reported the tool as a violation. A gate that
+# cannot pass over a correct tree teaches people to ignore it, and this one had
+# been red on main long enough for that to start.
+bin/vendormark
+bin/vendormark_test.sh