volt: verify gains a seventh leg -- doc-commands, graded at WORKTREE

The gate had six legs and none of them read a docstring's own command line.
doc_command_check.py existed since 838750c but only as a tool: nothing on the
gate ran it, so a documented flag its parser never learned could land and
nobody read it. This is that leg.

  doc-commands   tools/doc_command_check.py --rev WORKTREE --fail
                 WORKTREE, not HEAD: the commit window is where a docstring is
                 edited. Measured at the worktree this lands in: 67 commands
                 over 19 oracle tools, 67 OK, rc 0.

doc_command_check.py learns --rev WORKTREE: tracked paths from `git ls-files`
(an untracked tools/x.py is not part of the commit this mode grades), bytes
from disk. Outside a work tree it is rc 2, not an empty clean run. Selftest
15 -> 18 cells: one document edited on disk but not committed is rc 0 at HEAD
and rc 1 at WORKTREE, and the flag it names is the edited one.

Three tools stopped defaulting to a fixed path on this host. verify.py,
selftest_sweep.py, write_probe.py, citation_resolve_check.py,
path_claim_check.py and doc_census_check.py now resolve DEFAULT_REPO from the
file's own location, so a bare run in a clone grades the clone.

Three selftests refuse unreadable input at rc 2 instead of reporting it as
failed content: tool_map (not a work tree), write_probe (no table), and
citation_resolve_check (no corpus). Each cell below them graded `repo`, so an
absent tree read as "your table is wrong".

Evidence, all measured on this tree before the commit:
  verify.py --selftest              55 cells, 55 passed   (docstring says 55)
  doc_command_check.py --selftest   18 cells, 18 passed   (baseline pinned 18)
  tool_map.py --repo . --rev WORKTREE --check docs/TOOLS.md   rc 0
  verify.py --repo .                7 legs, 6 pass, 1 fault -- selftest-sweep,
                                    tool_map's drift cell, which renders HEAD
                                    and so cannot pass inside a commit window
tools/selftest_baseline.tsv re-pins doc_command_check.py 15 -> 18 cells.

tools/write_probe.py

@@ -130,6 +130,11 @@ import tempfile
 from collections import Counter
 
 JSON_FLAG = re.compile(r"add_argument\(\s*[\"']--json[\"']")
+
+# Same rule as every other tool here: the default target is the checkout this
+# file lives in, so a bare run in a clone grades the clone rather than a fixed
+# path on this host.
+DEFAULT_REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 # A caller-path write flag other than --json. The class is the two name families
 # this repo uses for "write the thing you were given a path for"; see THE SECOND
 # AXIS above for the boundary and why --emit-baseline is not in it.
@@ -407,6 +412,15 @@ def selftest(repo):
     """
     bad = []
 
+    # Cells below read `repo` (the tool table comes from its tracked tools/), so
+    # an unreadable repo turns three of them into FAIL -- "your table is wrong"
+    # when the truth is "I never saw your tree". Refuse at rc 2, the same code
+    # and the same sentence main() gives this input.
+    names, why = tracked_tools(repo)
+    if names is None:
+        print("cannot read: " + why, file=sys.stderr)
+        return 2
+
     def cell(name, ok, why=""):
         print(("  ok   " if ok else "  FAIL ") + name
               + ("" if ok else "  [%s]" % why))
@@ -585,7 +599,7 @@ def selftest(repo):
 
 def main(argv=None):
     ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
-    ap.add_argument("--repo", default="/root/troupe-standup")
+    ap.add_argument("--repo", default=DEFAULT_REPO)
     ap.add_argument("--only", default=None, metavar="TOOL")
     ap.add_argument("--timeout", type=int, default=180, metavar="S")
     ap.add_argument("--json", default=None, metavar="PATH")