Add a gate that keeps the codebase in US spellings

[mastacontrola]

#1457 made the tree clean. Nothing stopped it drifting back — this is the
gate. It runs inside the existing fogproject / tests context, so the
ruleset needs no new required check.

Why a whole-tree scan and not a diff

The obvious shape is "check only the lines this PR adds", and it was the
first thing tried. It needs a base ref, and this file cannot see or set
the checkout depth — the job that runs it lives in FOGProject/fog-workflows.
A shallow clone has no merge-base, so the check would find nothing to look
at and pass, for a reason that has nothing to do with spelling,
silently and on every pull request. A gate that can only report success is
worse than no gate, because it also reports "verified".

Scanning everything needs no ref, cannot skip, and is only possible
because the tree is already clean. Same principle the phpstan job is
built on: a gate that can only be satisfied, never one that grows.

Two patterns

One right-hand boundary cannot serve both shapes:

• word / camelCase — refuses a following lower-case letter, so enrol
  does not fire inside enrolled or enrollment. Left edge is "not
  preceded by a letter, or on a camelCase hump", so getCancelledState
  matches at the C.
• ALL CAPS — refuses a following letter of any case, or ENROL
  matches inside ENROLL_SECUREBOOT and the gate fails on a correctly
  spelled task type. ENROLMENT_MODE still matches, because _ is not a
  letter.

Both case-sensitive. A trailing /i also folds the [a-z] and [A-Z]
in the boundary assertions, collapsing the camelCase hump into "preceded
by a letter, followed by a letter" — no boundary at all. That mistake made
an earlier draft fire on labelling inside Relabelling, which reads like
a find and is really the guard rail dissolving.

File enumeration

git ls-files --cached --others --exclude-standard, because the two
obvious alternatives are each wrong in one direction:

• a filesystem walk drags in packages/web/lib/plugins/ — gitignored,
  root-owned, written by the installer rather than by this repo;
• plain git ls-files is blind to a file written but not staged, which is
  how a new class passed psr4-layout locally and failed in CI.

What writing it found

Three classes the sweep had missed:

• ALL-CAPS and capitalized forms — ENROLMENT, ENROL, RECOGNISES,
  Normalising, Initialised, Behavioural. An enumerated word list
  never listed them; the sweep now carries the match's own case.
• relabelling, plus afterwards, towards, judgement, ageing,
  artefact, programme.
• UK spellings inside identifiers the $-variable guard had skipped:
  $cancelled, $cancelledIDs, $jobcancelled, $SessCancelled,
  $inTaskCancelledIDs. All file-local, all renamed.

What stays UK, and why

getCancelledState(), the CANCELLED_STATE hook, and the
'cancelledState' key that hook hands a plugin in its arguments array.
All three are the plugin ABI — a plugin reading
$arguments['cancelledState'] breaks the moment that key is respelled.
Allowlisted with that reason in the file.

Proven by mutation, not by being green

Mutation	Result
lower-case word in a comment	fails ✓
Title-case word	fails ✓
ALL-CAPS standalone word	fails ✓
ALL-CAPS word inside SNAKE_CASE	fails ✓
camelCase identifier	fails ✓
UK word in an untracked new file	fails ✓
file enumeration broken	fails ✓ (loud, never a silent skip)
enrollment, enrolled, enrolling	stays green ✓
ENROLL_SECUREBOOT	stays green ✓

Known limit

It cannot see a UK word glued inside an all-lower-case identifier
(withenrol). No boundary separates that from a longer word, so it is out
of reach by construction rather than by oversight — said so in the file.

Verification

• tests/run-all.sh — 186 passed, 0 failed
• vendor/bin/phpstan analyse — no errors
• vendor/bin/phpstan analyse -c phpstan-tests.neon — no errors

The matching gate for FOS is FOGProject/fos#169.