docs: record why exclude_dirs stays unset, refresh matrix

The tool's defaults already exclude `vendor`, which covers the submodule at
scripts/vendor/jray-project. Setting the key explicitly is a trap worth
documenting: it REPLACES the defaults rather than extending them, and matching
is on path components rather than prefixes — so ["scripts/vendor"] matches
nothing while silently dropping __pycache__, node_modules, build and the rest.
Verified: the submodule's source is not scanned, and the only vendored path in
the report is the system spec it reads for PR/SR orphan checking.

Coverage after the merges: 5/63, 0 orphans. Every tag names a real requirement,
and nothing claims a requirement that is still Planned.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

traceability.toml

@@ -17,6 +17,16 @@ languages = ["cpp", "python"]
 
 source_roots = ["src", "tests", "scripts", "experiments", "eval"]
 
+# exclude_dirs is deliberately NOT set. The tool's defaults already exclude
+# `vendor` (among __pycache__, external, build, node_modules and friends), which
+# covers the submodule at scripts/vendor/jray-project — that is not this repo's
+# code, and its parser tests carry literal TRACES: strings that would otherwise
+# be credited here as coverage.
+#
+# Note the key REPLACES the defaults rather than adding to them, and matching is
+# on path components, not prefixes: setting it to ["scripts/vendor"] both fails
+# to match anything and silently drops every default exclusion.
+
 # CI is an Intel N100 with no discrete GPU. T4 is deliberately absent: a
 # requirement verifiable only on GPU hardware is reported as tagged but
 # unexecuted and never counted as covered, because counting a test that cannot