fix: drop submitter-needs-bound-form, which contradicts #1307

[vivek7405]

Closes #1384

Summary

Removes the submitter-needs-bound-form check rule and one false assertion in the scanner test. Both were written against renderer behaviour that does not exist, and both have reddened main since 7683c1ba, blocking every open PR including #1383.

#1307 made a bound submitter self-sufficient. The renderer stamps formmethod="post" and formenctype on the button itself, and per HTML a submitter's formmethod overrides the form's method. So a bound button posts correctly inside a form that is unbound, method-less, or even method="get". Measured against render-server.js at 034d6a0e:

<form method="get"><button formaction=${publish}>x</button></form>
  -> <form method="get"><button name="__webjs_action" value="…"
             formmethod="post" formenctype="multipart/form-data">x</button></form>

The rule's premise, stated in its own source comment, was that such a submission "defaults to GET, the identity rides the query string, and the page re-renders with the action never having run". That is false for every shape it flagged. In practice it was flagging #1307's own demonstration fixtures in examples/blog, one of which carries a doc comment explaining why it works. The differential test asserted a rejection matching /requires the enclosing <form> to also be bound/, a string that exists nowhere in packages/core/src or packages/server/src.

What changed

• Removed the rule from packages/server/src/check.js: the RULES entry, the call site, and checkSubmitterNeedsBoundForm() (about 440 lines), plus the now-unused scanHtmlFormScopes import.
• Deleted packages/server/test/check/submitter-needs-bound-form.test.js.
• Removed only the false assert.rejects block from html-form-scopes.test.js, keeping the scanner assertions around it and retitling the test.
• Corrected four doc surfaces that stated the enclosing form is what supplies method="post".

Deliberately not done

• The runtime diagnostics in form-dispatch.js stay. WEBJS_FORM_SUBMITTED_AS_GET and WEBJS_FORM_ACTION_MISSING detect a request SHAPE server-side and remain reachable however the request was produced (a hand-written form, an explicit formmethod="get" the renderer honours on a plain submitter, a stale cached page). test/bun/form-action-dispatch.mjs covers them and passes. The docs now say what actually reaches the first one.
• examples/blog is untouched. publish-button.ts and triage-split/page.ts are feat: make a bound form submitter self-sufficient, and honour the authored enctype #1307's fixtures. Editing them to satisfy the rule would have inverted cause and effect and deleted the proof that the feature works.
• scanHtmlFormScopes() is deleted too. It was added by feat: resolve form-submitter boundness in webjs check and make the residual loud #1314 solely to feed this rule, so removing the rule left it with no caller. Review then found it was not merely unused: its delivers field answers false for a form with no method, which is exactly the shape that now works, so the scan was wrong and its tests pinned the wrong values. The two live surfaces are salvaged into packages/server/test/scanner/form-action-holes.test.js: classifyActionHole, which the surviving form-action-not-a-get-action rule uses, and the enctype pin that keeps the renderer allowlist and the client guard's denylist from drifting.
• matchClosingBrace's fix from feat: resolve form-submitter boundness in webjs check and make the residual loud #1314 is kept. It is a real bug fix (brace depth was incremented at a ${ hole and never decremented) that five check rules and the elision analyser depend on.

Test plan

• webjs check passes on examples/blog, gallery and website, 0 violations each, with the blog files unmodified. Verified against the WORKTREE's own check.js: a linked worktree resolves bare @webjsdev/* to the primary checkout, so the first run silently tested the unmodified rule and still reported the violations.
• packages/server/test/scanner/html-form-scopes.test.js 18/18 on Node
• Same file 18/18 under bun test. It was the sole genuine Bun-matrix failure on main, and it is gone from the failure list.
• node scripts/run-bun-tests.js 310 pass, 27 documented node-only skips
• node --test 'test/docs/*.test.mjs' 27/27
• website boots in prod mode: /, /docs/troubleshooting, /docs/progressive-enhancement and /ui all 200 with no broken modulepreload

Two local failures are NOT from this diff, each confirmed by re-running at unmodified origin/main in the primary checkout:

• packages/server/test/elision/differential-elision.test.js:177 fails in the linked worktree, passes 9/9 in the primary.
• test/bun/listener.test.mjs fails in the worktree AND the primary, so it is pre-existing and local.

Neither can trace here: check.js is imported by nothing in the server request path, so this diff cannot affect rendering or the listener.

Layers that do not apply: browser and e2e (no routing, DOM, or client-router surface changes; the diff is a static analyser plus prose).

[vivek7405]

Went over the whole diff. The removal is right, and I checked the renderer directly rather than taking the rule's word for it: a bound submitter really does come out carrying its own formmethod="post" and formenctype in an unbound form, in a method="get" form, and with no form at all. So the rule was asserting a failure mode that cannot happen, and it was flagging the very fixtures #1307 added to prove that.

What I'd watch is that the premise outlived the rule in more places than the rule itself. Five surfaces still described, or were still built for, the enclosing-form question. Findings, all fixed in ec59af0c, anchored path-level because the fix deleted the lines they sat on:

1. packages/server/src/check.js kept matchClosingParenthesis and extractComponents imported with no call sites left. Their only uses were inside the deleted function.
2. gallery/modules/todo/actions/submit-todo.server.ts contradicted itself inside one comment block, saying the enclosing form does NOT have to be bound and then, twelve lines later, that it does. It also pointed readers at the removed rule. That file is scaffold payload, so it ships into every generated app.
3. packages/server/src/form-dispatch.js named the enclosing form as the cause in the production onError message for WEBJS_FORM_SUBMITTED_AS_GET, while the dev logger four lines above it already gave the real one. Two messages for one event, disagreeing.
4. packages/core/src/render-server.js still carried the four-state form-scope comment and passed a vestigial third argument to a two-parameter render(). Both are leftovers from the same #1307 removal, in the file this PR cites as its evidence.
5. packages/server/src/js-scan.js had scanHtmlFormScopes JSDoc describing a caller that no longer exists.

One thing left deliberately: scanHtmlFormScopes has no production caller now, since #1314 added it purely to feed this rule. I kept it and marked the JSDoc honestly rather than deleting another 250 lines plus a 330-line test file in a PR whose job is unblocking main. Worth a follow-up decision, not worth widening this diff.

[vivek7405]

Second pass, scoped to the previous round's fixes and their blast radius. It turned up the thing the first pass and I both missed, and it changes a call I had made.

scanHtmlFormScopes is not merely callerless. Its delivers field encodes the exact premise this branch removes: unboundFormDelivers answers false for a form with no method or a method="get" one, but a bound submitter now carries its own formmethod="post", which overrides the form, so those forms do deliver. Its tests asserted the wrong values, and the shape it would have scored false is examples/blog/app/feedback/triage-split/page.ts, whose action the e2e proves runs. So "unused but correct, keep it" was wrong, and I deleted it rather than documenting a lie. The two live surfaces are salvaged into form-action-holes.test.js: classifyActionHole, which the form-action-not-a-get-action rule still uses, and the enctype pin that keeps the renderer allowlist and the client guard's denylist from drifting.

Four more residuals of the same premise, all fixed:

1. packages/server/src/form-dispatch.js still told readers to look for a formmethod="get" on the pressed button. On a BOUND submitter that is refused at render, so the advice pointed at something that cannot exist. It now names a plain submitter, which is the case that actually reaches the diagnostic.
2. packages/core/src/render-server.js said the submission "still targets the page". It targets whatever the FORM targets, which is what invariant 12 and the gallery comment say. It also justified an early refusal by the enclosing form's boundness, which nothing computes any more.
3. packages/core/src/render-server.js streaming machine kept an orphaned form-scope comment dangling over an unrelated declaration, the same residual I cleaned in the buffered machine and missed in its twin.
4. SKILL.md, data-and-actions.md and muscle-memory-gotchas.md all called method="get" on a bound form a WEBJS_FORM_SUBMITTED_AS_GET warning. It is a thrown render error. Two of those files were edited by the earlier commit, so the stale claim survived a pass over the same lines.

Stopping the cycle here. The remaining risk is low: everything in this round was a comment, a message, a doc line, or the removal of code with no caller, and the renderer's observable output is unchanged across all three form shapes.