chore(template-sync): stop syncing scaffolding machinery into tenants

.templatesyncignore

@@ -1,7 +1,7 @@
 # .templatesyncignore — files an INSTANCE (tenant) created from this template OWNS.
 #
 # Same syntax as .gitignore. The weekly template-sync workflow
-# (devantler-tech/reusable-workflows .github/workflows/template-sync.yaml, using
+# (devantler-tech/actions .github/workflows/template-sync.yaml, using
 # AndreasAugustin/actions-template-sync) is skipped in this template repo itself
 # and runs in every tenant created from it — opening a PR that brings template
 # changes downstream. It only ever touches files that exist in this template, and
@@ -11,8 +11,8 @@
 # Everything NOT listed here is TEMPLATE-OWNED shared plumbing kept current in
 # every tenant by template-sync — change those upstream in
 # devantler-tech/gitops-tenant-template, never by editing them in a tenant.
-# Template-owned files: .github/workflows/{cd,release,template-sync,validate-scaffold,sync-labels}.yaml,
-# CLAUDE.md, zizmor.yml, scripts/rename-placeholders.sh.
+# Template-owned files: .github/workflows/{cd,release,template-sync,sync-labels}.yaml,
+# CLAUDE.md, zizmor.yml.
 
 # --- Identity & docs (tenant-specific) ---
 AGENTS.md
@@ -34,5 +34,15 @@ LICENSE
 deploy/
 Dockerfile
 
+# --- Scaffolding machinery (template-only; dead code in a live tenant) ---
+# These exist to rename placeholders when a NEW repo is created from this
+# template ("use this template" copies everything, so scaffolding still arrives
+# at creation time). A scaffolded tenant never runs them again — ignoring them
+# stops template-sync (re-)introducing them downstream, so a tenant that still
+# carries them can delete them and they stay gone.
+scripts/rename-placeholders.sh
+scripts/rename-placeholders.test.sh
+.github/workflows/validate-scaffold.yaml
+
 # --- This ignore-list itself (the tenant curates its own ownership) ---
 .templatesyncignore

README.md

@@ -46,11 +46,17 @@ app code.
 | `.github/workflows/cd.yaml` | On a `v*` tag, calls `publish-app.yaml` to build, digest-pin, push, and **cosign-sign** the image + manifests OCI artifact |
 | `.github/workflows/release.yaml` | semantic-release on `main` (cuts the `v*` tags that drive `cd.yaml`) |
 | `.github/workflows/template-sync.yaml` | Opens the weekly template-sync PR |
-| `.github/workflows/validate-scaffold.yaml` | Renders `deploy/` (`kubectl kustomize`) **and schema-validates** every rendered resource with `kubeconform` (`-strict`, built-in schemas + a pinned CRD catalog) to gate template-repo PRs against a broken *or schema-invalid* scaffold; **no-ops in tenants** (you validate your own `deploy/` via `ci.yaml`) |
 | `.github/workflows/sync-labels.yaml` | Syncs the repo's issue/PR labels from the canonical label set |
 | `CLAUDE.md` | `@AGENTS.md` shim |
 | `zizmor.yml` | GitHub Actions pinning policy enforced by the security scan |
-| `scripts/rename-placeholders.sh` | One-shot rename of the placeholder app to your tenant name |
+
+**Scaffold-time only (arrives when the repo is created — never re-synced, so a
+tenant still carrying these from an older sync can delete them for good):**
+
+| File | Purpose |
+|---|---|
+| `.github/workflows/validate-scaffold.yaml` | Renders `deploy/` (`kubectl kustomize`) **and schema-validates** every rendered resource with `kubeconform` (`-strict`, built-in schemas + a pinned CRD catalog) to gate template-repo PRs against a broken *or schema-invalid* scaffold; no-ops in tenants |
+| `scripts/rename-placeholders.sh` (+ its test) | One-shot rename of the placeholder app to your tenant name |
 
 **Yours (list these in `.templatesyncignore`):**
 
@@ -68,6 +74,12 @@ README.md
 LICENSE
 deploy/
 .templatesyncignore
+
+# Template scaffolding — dead code in a live tenant; keep ignored so a
+# template-sync never re-introduces it after you delete it.
+scripts/rename-placeholders.sh
+scripts/rename-placeholders.test.sh
+.github/workflows/validate-scaffold.yaml
 ```
 
 `AGENTS.md` and the `maintain` skill ship as scaffolding (a starting point for new