create-vale-rule: verify with the vendored binary, never a system vale; and check already excludes .taskless/

[thecodedrift]

From the 2026-09-21 dogfood notes.

A first attempt validated rules with Homebrew's Vale 3.15 while Taskless pinned 3.20; rules that passed on one and not the other proved nothing. create-vale-rule.md only says this obliquely (the format lists "are rendered from the pinned Vale version"). It should say outright: a bare vale run proves nothing about what check will report; use taskless verify and taskless check, which run the vendored binary.

Related, from the same repo's config: every rule carries a trailing matcher so fixtures that hold violations on purpose stay quiet under a bare vale run:

# Fixtures carry violations on purpose. Last section wins on 3.21.
[.taskless/**/*.md]
tskl) rule = no-em-dashes
no-em-dashes.no-em-dashes = NO

check already excludes .taskless/ unconditionally before Vale runs (packages/cli/src/rules/vale/formats.ts, "separately and unconditionally excluded"), so that block only does work for the bare-vale case the first paragraph tells people not to rely on. The recipe should say so, so authors do not cargo-cult a fourth matcher into every rule.

What to do

• Recipe: one passage — validate through taskless verify / check only; .taskless/ is excluded by check, a .taskless/** matcher is unnecessary; topic version bump.
• The schema in vale: parse per-rule .vale.ini into an AST, validate it with a schema, refuse a bad config at assembly #359 reports a .taskless/** matcher as a warning with the same message.
• No changeset (recipe only).