fix(arckit-fr): align guides, templates and commands with French primary sources (#949)

[tractorjuice]

Part of #949.

Brings the French overlay's commands, templates, guides, README and the shared quality checklist into line with the primary sources for the items #949 lists under "France (arckit-fr)".

Decisions

Item	Decision	Primary source
RGESN criteria count	Both sides were wrong. RGESN 2024 (current version 2) has 78 criteria in 9 families: Stratégie 10, Spécifications 10, Architecture 7, UX/UI 15, Contenus 8, Frontend 7, Backend 4, Hébergement 10, Algorithmie 7. The template table had 79 criteria in 8 categories, and its per-category counts were wrong too.	ecoresponsable.numerique.gouv.fr — RGESN (criteria counted from the page's 78 accordion entries)
fr-code-reuse circular	The command and template were right: Circulaire n°6264/SG du 27 avril 2021 (NOR PRMX2113491C). The guide's "2021-1524" was wrong. I normalised "6264-SG" to the official "6264/SG". The circular's text directs ministries to strengthen the opening of source code and the use of free software. It sets no stand-alone "reuse before build" rule. Guide, command, template and checklist now call it a policy instruction from the Prime Minister, not a statute or legal obligation.	Légifrance circulaire 45162; full text read from the signed PDF
fr-anssi structure	Neither side matched the source. The Guide d'hygiène informatique (v2.0, 2017) has 42 measures in 10 chapters, I to X (3/4/6/5/8/3/4/2/5/2). It does not have 7 themes. The template's measure list (e.g. "41 Subscribe to CERT-FR") did not match the guide's numbering. Template, command step 4b, guide and README now follow the guide's own checklist (outil de suivi). Wi-Fi is measure 20, and CERT-FR monitoring is part of measure 34. Status is assessed at the standard level, with renforcé noted, as the guide's method says.	MesServicesCyber — Guide d'hygiène informatique (PDF)
fr-anssi cloud date	The command was right on the year: Recommandations pour l'hébergement dans le cloud des SI sensibles, version 1.0, July 2024 (published 9 July 2024). The template's "2021" and the checklist's "ANSSI 2021" were wrong. "Updated 8 July 2024" is now "version 1.0, July 2024". The old cyber.gouv.fr URL redirects to a generic cloud page, so the link now points to MesServicesCyber. Command and template also gain the IS-category step, because the recommendations are organised by IS category.	MesServicesCyber — cloud recommendations (PDF)
fr-anssi priorities	The guide now uses the template's 🔴 High / 🟠 Medium / 🟡 Low instead of P1–P3. The command's High definition now uses the template's "before go-live or within 30 days".	— (internal alignment)
fr-algorithme-public	The command was right. The duty covers decisions taken sur le fondement of an algorithm, whatever the degree of human involvement. R311-3-1-2 1° requires disclosure of "le degré et le mode de contribution du traitement algorithmique à la prise de décision", and DINUM's guide says the obligations apply "quel que soit le degré d'intervention humaine". Weights are communicated to the individual on request (R311-3-1-2 3°), not published for every algorithm. L312-1-3 publishes the rules of the main processes, for administrations with 50 or more agents. Both are limited by secrets protected by law (L311-5 2°, L311-6), and partial disclosure follows L311-7. Guide fixed. The command's "if doing so would enable gaming" now names those legal grounds.	Décret n° 2017-330 (R311-3-1-1/2), CRPA R311-3-1-2, CRPA L312-1-3, CRPA L311-5, DINUM guide on public algorithms
SecNumCloud §4	The command was right. Template §4 is renamed "OIV/OSE and Arrêté du 12 août 2026 Obligation Mapping" and gains §4.3, which assesses the binding obligation independently of OIV/OSE status. §1.2 gains the arrêté row. I verified the arrêté exists: JORF n°0189 of 14 August 2026. The checklist gains a matching SECNUM check.	Légifrance JORFTEXT000054678082; JO 14 août 2026
Marché public sections	The command was right with 8 sections. The template gains §7 (ANSSI-qualified provider selection), and Digital State Doctrine becomes §8. The guide's section table listed RC/CCTP/CCAP/Durabilité, which the command does not produce, so it now lists the 8 real sections. README updated to match.	— (internal alignment)
PSSI domains	The template was right with 8 domains (6.1–6.8). The command said seven and missed vulnerability management. Command, guide, README and checklist now name the template's 8 domains. The guide's 9-section table now matches the template's section titles. The guide's FSSI gloss ("Functional IS security officer") now matches the template: Fonctionnaire de sécurité des SI.	— (internal alignment)
Recipe order	Not applicable. plugins/arckit-fr/ ships no recipes, and its README says so.	—

Files changed

• plugins/arckit-fr/commands/: fr-dinum.md, fr-code-reuse.md, fr-anssi.md, fr-algorithme-public.md, fr-pssi.md
• plugins/arckit-fr/templates/ and .arckit/templates/ (identical pairs): fr-dinum, fr-code-reuse, fr-anssi, fr-secnumcloud, fr-marche-public
• docs/guides/: fr-dinum, fr-code-reuse, fr-anssi, fr-algorithme-public, fr-marche-public, fr-pssi. Plugin copies synced with check-guide-parity.py --sync.
• README.md: the fr-anssi, fr-marche-public, fr-pssi and fr-code-reuse entries
• plugins/arckit-claude/references/quality-checklist.md (SECNUM, ANSSI, PSSI and REUSE checks), propagated by sync-shared-assets.py to every community plugin
• Nested plugins/arckit-claude/plugins/ mirror, from sync-claude-plugin-layout.py

No handoff or input level changed, so DEPENDENCY-MATRIX.md and commands.html are untouched. v1.0 write targets and version-detection wording are unchanged. DR is left alone, as is the RES→RSCH fix from #964.

Judgement calls left open

• PDCS. The fr-marche-public command and guide list "PDCS (Prestataires de Cybersécurité pour les Collectivités)" as an ANSSI qualification. I could not confirm it exists: cyber.gouv.fr's référentiels page is bot-protected, and searches turn up only PASSI, PRIS, PDIS, PACS, PVID and SecNumCloud. I did not carry PDCS into the new template §7. The command and guide rows are untouched. Suggest checking the ANSSI référentiels page and probably replacing it with PACS.
• fr-code-reuse publication duty. The command and template cite Loi République numérique Art. 16 for the duty to publish source code. Art. 16 tells administrations to encourage free software and open formats. The publication duty more likely rests on CRPA L300-2 (source code is an administrative document) and L312-1-1. Not changed here.
• Sustainable procurement. The command produces no environmental award criterion or clause. Loi Climat et Résilience (CCP L2152-7) requires one by August 2026. I removed the README's "Achat public durable" bullet because the command does not produce it. The gap in the command itself is left open.
• CRPA amendment. Légifrance shows L311-5 amended by loi n° 2026-403 of 26 May 2026. I could not read the consolidated text, so the PR cites "L311-5 2°" without a letter.
• Other items noticed, not changed:
  • The fr-dinum command calls RGESN "2024: legally binding for many entities".
  • The MARPUB checklist threshold reads €215k; the guide says €216k.
  • The SecNumCloud command gives 15 August 2026 as the entry-into-force date, and secondary sources disagree on it.
• I removed "social scoring" from the guide's examples of covered decisions. Social scoring by public authorities is prohibited under the EU AI Act, so it is not a covered decision type.

Checks

Check	Result
uv run --no-project --with pytest --with pyyaml --with-editable . python -m pytest -q -p no:cacheprovider	2420 passed, 228 skipped
node --test tests/plugin/*.test.mjs tests/plugin/test_*.mjs tests/certification/*.test.mjs	653 pass, 0 fail
Lint checks runner (run_lint_checks.py)	34 checks, 0 failed
npx --yes markdownlint-cli2@0.18.1 "**/*.md"	0 errors (4321 files)
check-guide-parity.py	OK

🤖 Generated with Claude Code