fix(m1): build the public-surface canary at runtime so the scanner scans itself

tests/test_public_surface.py

@@ -169,9 +169,17 @@ def test_security_md_states_the_trust_model():
 
 def test_no_tracked_file_carries_a_home_path_or_a_real_address(tmp_path):
     # Prove the scan can find before believing that it found nothing.
+    #
+    # The canary is assembled from parts rather than written out, and that is
+    # not fussiness: this file is tracked, so the scan reads it too. A literal
+    # canary here would be a finding in the scanner's own source -- which is
+    # exactly what the M1 gate caught the first time this file was committed.
+    # Building it at runtime keeps the scanner subject to its own rule instead
+    # of exempting itself from it.
     kanari = tmp_path / "kanari.md"
     kanari.write_text(
-        "Se /Users/enperson/hemmelig/mappe/ og https://ekte-jobbportal.no/annonse/12345\n",
+        "Se /%s/enperson/hemmelig/mappe/ og https://ekte-%s.no/annonse/12345\n"
+        % ("Users", "jobbportal"),
         encoding="utf-8",
     )
     kanarifunn, kanarilest, _ = skann(str(tmp_path), ["kanari.md"])