fix(i18n): reject guard allowlist entries that match no file (#2275)

Co-authored-by: Kandev Agent <agent@kandev.dev>

docs/i18n.md

@@ -261,11 +261,22 @@ node -e 'console.log(require("fs").globSync("app/settings/workspace/[[]id[]]/aut
 ```
 
 The Automations migration (#2247) shipped the unescaped form, and review caught
-it. So when an entry contains `[`, escape it as `[[]…[]]` — and prove the entry
-is live rather than trusting the glob result, the same way you would prove any
-other check earned its pass: put a hardcoded literal in one of the files the
-entry is supposed to cover and confirm `pnpm lint` reports
-`i18next/no-literal-string`, then remove it. A silent 0 errors is the tell.
+it. So when an entry contains `[`, escape it as `[[]…[]]`.
+
+`check-guard-allowlist.mjs` now rejects an entry that matches no file, so this
+particular class cannot recur — the three checks it runs are deliberately
+separate because each is blind to the others' failure:
+
+| check | sees |
+|---|---|
+| removal | an entry that **left** the array while its path still exists |
+| duplicate | an entry listed **twice** |
+| unmatched | an entry that **never matched anything**, including on the day it was added |
+
+The first two compare two *states* of the array, which is why neither can see a
+born-dead entry. If you add a check here, add the test that shows the existing
+ones miss what it catches — `scripts/lib/guard-allowlist.test.ts` pins that for
+all three.
 
 ### …but new code is guarded everywhere