De-fork follow-up: census self-scan exclusion + wire ratchet CI step

Once script/upstream/ is committed (S1, PR #1013), \`census.ts --check --ours HEAD\` scans its OWN tooling files (analyze.ts, census.ts, bridge-merge.ts, audit-unwrapped.ts, README.md, unclosed-marker-allowlist.jsonc) which legitimately contain \`altimate_change start\` as code/data — the census parser then throws "unclosed marker" on those string literals.

**Fix:** census.ts should exclude its own tooling directory (script/upstream/) from the marker scan — scanning the marker-checking tooling for markers is a category error, and those files contain zero real altimate_change blocks (only string-literal false-positives), so excluding them keeps the fork_owned count consistent with the current baseline.

**Then:** regenerate the 2026-07-18 baseline (should be identical block counts), add the deferred census-ratchet CI step back to .github/workflows/ci.yml (with a defork-exemption for the ci.yml ratchet-step marker), and verify \`census.ts --check\` passes at the committed HEAD.

Deferred from the S1 PR (#1013) to keep its CI green. The tooling + baselines are correct; only the CI ratchet guardrail wiring waits on this.