Move the publish script out of the scoped workflow into a file

tools/publish_wiki.py holds the 296 lines that were embedded in
publish-wiki.yml, unchanged in behaviour and messages. The scoped workflow
now checks out the repository that owns the wiki and TirSystem/github-action
at main, and runs the file (42 lines instead of 313). The tests import the
file, and a new test asserts that no workflow embeds Python. README and the
Home wiki page with its translations no longer mention embedded Python.
Verified live from TirSystem-BashScript/RepoFoundry.

Task: MIL-004#6

tests/test_workflows.py

@@ -41,6 +41,17 @@ def test_sync_workflow_embeds_no_script_and_runs_the_file():
     assert steps[-1]["run"] == "python3 shared-scripts/tools/sync_github_metadata.py"
 
 
+def test_no_workflow_of_this_repository_embeds_python():
+    """MIL-004 Go/No-Go criterion 5: every script is a file under tools/."""
+    embedded = {path.name: len(embedded_python(path)) for path in WORKFLOWS}
+    assert {name: count for name, count in embedded.items() if count} == {}
+
+
+@pytest.mark.parametrize("script", sorted((REPO_ROOT / "tools").glob("*.py")), ids=lambda p: p.name)
+def test_every_tool_script_compiles(script):
+    ast.parse(script.read_text(encoding="utf-8"), filename=str(script))
+
+
 def test_sync_script_compiles_and_is_a_file_of_this_repository():
     source = SYNC_SCRIPT.read_text(encoding="utf-8")
     ast.parse(source, filename=str(SYNC_SCRIPT))