Name the verdict check among the invariants the build defends

2cde2874 made `cargo test -p traceability` fail on any write of a
rating, flag, colour label or trash membership that is not on a
reviewed list, and CONTRIBUTING.md, which lists what CI will stop a
change for, did not mention it. It is now the third invariant beside
the ui-names-no-operation test and the operation schema: what it finds,
the kinds of reason a write can be listed with, that the workspace test
run is what runs it, and `traceability -- verdicts` to print the list.

CONTRIBUTING.md

@@ -148,9 +148,9 @@ screen looks like, [`tools/manual`](tools/manual/README.md) says how to record
 it again. The pre-commit hook regenerates the matrix, the gesture book and the
 page; CI runs all three checks.
 
-## Two invariants the build defends
+## Three invariants the build defends
 
-Worth knowing before you trip one, because both failures name a requirement
+Worth knowing before you trip one, because each failure names a requirement
 rather than a line:
 
 - **No operation may be named in `ui/`** (FR-DEV-3a). Special-casing one
@@ -162,6 +162,16 @@ rather than a line:
   `order:`, a filename disagreeing with its `id:`, a default outside its own
   range, an expression naming something that is not a parameter. Each error
   names the key you got wrong and exits rather than panicking.
+- **No verdict is written without a user action** (FR-CULL-13). A rating,
+  flag, colour label or trash membership is the photographer's to set, never a
+  signal's. `tools/traceability/src/verdicts.rs` finds every write of one in
+  the shipped code — the catalog setters, SQL that assigns those columns, the
+  sidecar's judgement amendment — and holds each to a reviewed list with its
+  reason: inside a Slint `on_*` callback, writing for callers that are checked
+  in turn, or carrying a verdict made elsewhere, such as a sidecar pull or the
+  sync merge. A new write fails `cargo test` (the `traceability` crate's tests,
+  part of the workspace run) until it is listed, and so does a listed one that
+  has gone; `cargo run -p traceability -- verdicts` prints the list.
 
 ## Commit messages