perimeter.py: narrow design_docs/* governance to *.md, so design_docs/tools/ code isn't gated nf-1fhf ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/925 by tools/beads/import_github.py's reconcile pass.

design 008 (#913, T3) introduces design_docs/tools/operationalize_design.py — the first precedent for subject-colocated tooling living inside design_docs/ rather than the central tools/ tree (the broader naming-guidelines question that raises is tracked separately in #918, unclaimed). Today tools/nflib/perimeter.py's GOVERNANCE tuple denies the whole design_docs/* tree (fnmatch's * crosses /, so this covers any depth — see test_a_nested_design_doc_is_denied_too), which would put ordinary tooling code and its tests under the same human-approval gate as the design docs themselves. @aedanpope: that's not intended — code under design_docs/tools/ should merge on the normal bot review, same as any other tooling.

The fix, minimal and staying inside the existing deny-list mechanism (no new allow/exclude logic): narrow the GOVERNANCE tuple's "design_docs/*" entry to "design_docs/*.md". This still denies every markdown file at any depth (fnmatch's * still crosses /, so a nested appendix like design_docs/005-probe-selection/appendix.md stays governed — the exact case test_a_nested_design_doc_is_denied_too guards), but no longer matches .py files anywhere under design_docs/, including design_docs/tools/**.

Files: tools/nflib/perimeter.py (the one-line pattern change, plus updating the explanatory comment above GOVERNANCE's design_docs/* entry to note the narrowing and why). tools/tests/test_nflib_perimeter.py: - Existing tests (test_the_whole_design_docs_tree_is_denied, test_a_nested_design_doc_is_denied_too, test_design_docs_denial_does_not_lean_on_the_new_folder_rule) should all still pass unchanged — every path they assert on is .md. - Add a new test asserting design_docs/tools/operationalize_design.py (and its test file, wherever T2/T3's convention puts it — check #924's tools/github_live/ precedent for the sibling-tests-dir pattern) is not governance-denied — the positive case this issue exists for.

Done when: the new test passes, all existing test_nflib_perimeter.py tests still pass unchanged, and ./presubmit.py --all is green.

⚠️ This PR touches tools/nflib/perimeter.py itself, which is governance-denied — it will need @aedanpope's approval to merge regardless of the fix's content. That's expected and correct; only the *result* (design_docs/tools/ code no longer being gated) is what this issue changes.

Unblocks design 008 T3 (design_docs/tools/operationalize_design.py, tracked on #913) from needing his approval to merge.