Move the publish script out of the scoped workflow into a file

tools/publish_wiki.py holds the 296 lines that were embedded in
publish-wiki.yml, unchanged in behaviour and messages. The scoped workflow
now checks out the repository that owns the wiki and TirSystem/github-action
at main, and runs the file (42 lines instead of 313). The tests import the
file, and a new test asserts that no workflow embeds Python. README and the
Home wiki page with its translations no longer mention embedded Python.
Verified live from TirSystem-BashScript/RepoFoundry.

Task: MIL-004#6

wiki/Home.da.md

@@ -1,4 +1,4 @@
-<!-- translation of Home.md, source sha256 758940401ac1 -->
+<!-- translation of Home.md, source sha256 eedaeddbea3e -->
 
 > Dette er en oversættelse af [`Home`](Home). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
 
@@ -45,7 +45,7 @@ Workflows kører automatisk ved push til `main` og efter den daglige tidsplan. F
 
 ## Tests
 
-Workflow-filerne og den Python-kode, der er indlejret i dem, valideres af offline-tests, som hverken kræver netværksadgang eller secrets:
+Workflow-filerne og scripts i `tools/` valideres af offline-tests, som hverken kræver netværksadgang eller secrets:
 
 ```bash
 python3 -m venv .venv
@@ -54,6 +54,6 @@ python -m pip install -r tests/requirements.txt
 python -m pytest -q tests
 ```
 
-De samme kontroller kører ved hver pull request og hvert push til `main` gennem [`validate-workflows.yml`](https://git.tirsystem.com/TirSystem/github-action/src/branch/main/.gitea/workflows/validate-workflows.yml). De parser alle workflows som YAML, kompilerer den indlejrede Python-kode, kræver eksplicitte jobtilladelser og tester parsing af credentials, parsing af push-spejlets adresse og synkroniseringsforløbet mod et falsk API.
+De samme kontroller kører ved hver pull request og hvert push til `main` gennem [`validate-workflows.yml`](https://git.tirsystem.com/TirSystem/github-action/src/branch/main/.gitea/workflows/validate-workflows.yml). De parser alle workflows som YAML, kontrollerer at ingen indlejrer Python, kompilerer scripts i `tools/`, kræver eksplicitte jobtilladelser og tester parsing af credentials, parsing af push-spejlets adresse og synkroniserings- og publiceringsforløbene mod et falsk API.
 
 Efter en ændring af synkroniseringsworkflowet skal du også starte **Sync GitHub mirror metadata** manuelt i Gitea og sammenligne beskrivelsen og emnerne på GitHub-spejlet.

wiki/Home.md

@@ -45,7 +45,7 @@ Workflows run automatically on push to `main` and on the daily schedule. To run
 
 ## Tests
 
-The workflow files and the Python embedded in them are validated by offline tests that need no network access and no secrets:
+The workflow files and the scripts in `tools/` are validated by offline tests that need no network access and no secrets:
 
 ```bash
 python3 -m venv .venv
@@ -54,6 +54,6 @@ python -m pip install -r tests/requirements.txt
 python -m pytest -q tests
 ```
 
-The same checks run on every pull request and push to `main` through [`validate-workflows.yml`](https://git.tirsystem.com/TirSystem/github-action/src/branch/main/.gitea/workflows/validate-workflows.yml). They parse every workflow as YAML, compile the embedded Python, require explicit job permissions, and test credential parsing, push mirror address parsing and the sync flow against a fake API.
+The same checks run on every pull request and push to `main` through [`validate-workflows.yml`](https://git.tirsystem.com/TirSystem/github-action/src/branch/main/.gitea/workflows/validate-workflows.yml). They parse every workflow as YAML, check that none embeds Python, compile the scripts in `tools/`, require explicit job permissions, and test credential parsing, push mirror address parsing and the sync and publish flows against a fake API.
 
 After a change to the sync workflow, also trigger **Sync GitHub mirror metadata** manually in Gitea and compare the description and topics on the GitHub mirror.

wiki/Home.ms.md

@@ -1,4 +1,4 @@
-<!-- translation of Home.md, source sha256 758940401ac1 -->
+<!-- translation of Home.md, source sha256 eedaeddbea3e -->
 
 > Ini ialah terjemahan [`Home`](Home). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
 
@@ -45,7 +45,7 @@ Aliran kerja berjalan secara automatik pada push ke `main` dan mengikut jadual h
 
 ## Ujian
 
-Fail aliran kerja dan kod Python yang tertanam di dalamnya disahkan oleh ujian luar talian yang tidak memerlukan akses rangkaian dan tidak memerlukan rahsia:
+Fail aliran kerja dan skrip dalam `tools/` disahkan oleh ujian luar talian yang tidak memerlukan akses rangkaian dan tidak memerlukan rahsia:
 
 ```bash
 python3 -m venv .venv
@@ -54,6 +54,6 @@ python -m pip install -r tests/requirements.txt
 python -m pytest -q tests
 ```
 
-Semakan yang sama dijalankan pada setiap pull request dan setiap push ke `main` melalui [`validate-workflows.yml`](https://git.tirsystem.com/TirSystem/github-action/src/branch/main/.gitea/workflows/validate-workflows.yml). Semakan itu menghurai setiap aliran kerja sebagai YAML, mengkompil Python yang tertanam, memerlukan kebenaran kerja yang jelas, dan menguji penghuraian kelayakan (credentials), penghuraian alamat push mirror dan aliran penyegerakan terhadap API palsu.
+Semakan yang sama dijalankan pada setiap pull request dan setiap push ke `main` melalui [`validate-workflows.yml`](https://git.tirsystem.com/TirSystem/github-action/src/branch/main/.gitea/workflows/validate-workflows.yml). Semakan itu menghurai setiap aliran kerja sebagai YAML, memastikan tiada yang menanam Python, mengkompil skrip dalam `tools/`, memerlukan kebenaran kerja yang jelas, dan menguji penghuraian kelayakan (credentials), penghuraian alamat push mirror serta aliran penyegerakan dan penerbitan terhadap API palsu.
 
 Selepas perubahan pada aliran kerja penyegerakan, cetuskan juga **Sync GitHub mirror metadata** secara manual dalam Gitea dan bandingkan penerangan dan topik pada cermin GitHub.