Fold demo-build learning: derive the scrub token list in-session, retire scrub-list.txt

[Justinvolved]

The sanitize gate read its engagement tokens from an external per-engagement scrub-list.txt. That mechanism failed recurringly in practice: the documented location ($DYNAMICWEB_SKILLS_REPO\..\..\scrub-list.txt) resolves to an unwritable path on a standard clone layout, so folds stalled on "scrub list not found" instead of scrubbing — and the file itself was redundant, since every token that could leak into a fold is by construction present in the material being folded.

Changes to dw-demo-base/references/iterate-plugin.md:

• Step 1a grep pack: the token list is now enumerated in-conversation each fold, written out for user review, with an explicit checklist of shapes to cover — brand names incl. misspellings and slugs, hostnames, persona/account names, engagement domain vocabulary (field names, example products), demo-minted ids/paths/credentials. The constant packs (session-relative time, customer-path shape) are unchanged.
• New mandatory adversarial re-read of the staged diff: for every concrete string, "Dynamicweb-generic, or engagement-derived?" — the grep catches only enumerated tokens; the re-read catches non-generic wording the enumeration missed.
• Removed: the scrub-list file location contract, the stub-creation step, the "when to expand the known-names list" section, and the Get-Content in the final pre-commit grep.

Version 4.10.0 (4.9.0 is claimed by the in-flight #58; entries are independent — whichever merges second takes a trivial CHANGELOG/version rebase).

Gates: validate-skills.py exit 0; in-session scrub pack over the staged diff — 0 name hits, 1 time hit which is the doc's own pattern-definition line.