Retire the dispatch.sh / app_token.sh shims — #784 removed their only caller nf-7qz ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/789 by tools/beads/import_github.py's reconcile pass.

Filed unclaimed by nf-dev-rev-pass-gate while working #784. Not claimed, not labelled.

What changed

tools/reviewer/dispatch.sh and app_token.sh are one-line exec python3 … shims. Their own headers state the reason they exist:

> ⚠️ WHY NOT JUST DELETE IT. The reviewer is a schtasks job invoking this path […] So the merge that removes this file is also the moment the running tick's own source disappears — and a merge is not a deploy for a scheduled job (#461)

#784 deleted that job. Nothing outside this repo calls either shim any more, so the blocker notes/shell-policy.md recorded is gone.

Why #784 did not do it

~10 citations of the form dispatch.sh:530-662, dispatch.sh:538, dispatch.sh:72 are load-bearing provenance — they record where each rule in dispatch.py was ported from, which is most of what makes that file's ⚠ comments checkable. And tools/tests/test_doc_pointers.py::test_every_LINE_CITED_path_is_tracked requires every cited path to be git-tracked, so deleting the file turns the presubmit red until each citation is rewritten.

That test's own docstring anticipates this:

> ⚠ Deliberately does NOT assert dispatch.sh. That file's retirement is already scheduled (notes/shell-policy.md), and pinning it here would make a correct future prose edit fail this test as well as the scan

So the work is: decide whether the provenance is rewritten (to what? the file will not exist) or dropped, then delete. That is a judgment call about how this repo cites history, not a tidy-up — which is why it was not bundled into a deletion PR.

Surfaces

• tools/reviewer/dispatch.sh, tools/reviewer/app_token.sh
• ~10 dispatch.sh:<line> citations, mostly in tools/reviewer/dispatch.py docstrings, plus tools/nflib/app_token.py, tools/tests/test_nflib_env.py, tools/tests/test_nflib_verdict.py
• notes/shell-policy.md — the "three exec shims" list becomes one (publish.sh, which is genuinely not optional)
• tools/reviewer/README.md — the Files entry
• tools/tests/test_doc_pointers.py — the docstring quoted above

⚠️ publish.sh is not part of this. The game checks File.Exists on it and treats absence as "exported build, no repo" — deleting it silently stops every same-sitting publish.