Clear the regions locale column without going blind

check:universal-props showed regions-dashboard LOCALE = warn on a single
site: the map popup's fixed en-US population. That is a HELD decision, not
an oversight -- their own site renders en-US numerals, it is carded, and
_chk-numerals-held-format-does-not-vary-by-locale ASSERTS it does not vary
by locale, so making it locale-derived would break a gate that exists to
keep it fixed.

Clearing it had only two mechanisms and both were wrong. Changing the code
reverses a Driver-backed ruling. A bundle-wide ALLOW silences every FUTURE
en-US anywhere in regions-dashboard -- clearing a column by going blind.

So ALLOW is now site-scopable: a `bundle:RULE:file` key exempts the one file
that earned it, falling back to the old `bundle:RULE` form. The entry records
the card and the reason.

Verified in both directions: the column reads `allowed` instead of `warn`,
and planting a new operative en-US in regions-list.vue puts it straight back
to `warn` naming that file. The exemption is one file wide, not one bundle.

`allowed` is the honest terminal state here, not `ok`. `ok` would mean the
numerals follow the locale, and they deliberately do not.

internal/check-universal-props.mjs

@@ -58,6 +58,14 @@ const BUNDLES = [
 ]
 const ALLOW = {
   'prayer-walk-planner:ENG-PIN': 'keyless by design: always MapLibre, needs no token (index.js header)',
+  'regions-dashboard:LOC-ENUS:plugin-designs/regions-dashboard/src/RegionCountryMap.vue':
+    'HELD DECISION, not an oversight: the map popup formats population as fixed en-US on purpose. '
+    + 'Their own site renders en-US numerals, which is the evidence on the card '
+    + 'NUMERALS-REVERTED-POPUP-TO-FIXED-EN-US-AND-THEIR-OWN-CONVENTION-IS-EVIDENCE, and '
+    + '_chk-numerals-held-format-does-not-vary-by-locale ASSERTS it does not vary by locale -- so '
+    + 'making it locale-derived would break a gate that exists to keep it fixed. Scoped to this FILE: '
+    + 'the rest of regions-dashboard is still answerable for a new en-US. Revisit only if the Driver '
+    + 'rules the numerals policy.',
   'all-people-groups:LIST-DSM': 'draws the IMB dataset (all 12,379 groups), not the DOXA list: a list there is Tier B (SPEC-PEOPLE-GROUP-LIST-PROP.md)',
 }
 
@@ -237,7 +245,13 @@ for (const b of BUNDLES.filter((x) => !ONLY || ONLY.includes(x))) {
       // bundles when the sweep first reached it, which is a gate telling four owners that the library
       // is broken because it read the definition as a use.
       if (r.id === 'LIST-DSM' && /library\/api\/DataSourceManager\.js$/.test(f.replace(/\\/g, '/'))) continue
-      const allowed = ALLOW[`${b}:${r.id}`]
+      // ★ ALLOW IS NOW SITE-SCOPABLE, because bundle-wide was the wrong granularity for a HELD
+      // decision. regions-dashboard's one LOC-ENUS is a deliberate fixed en-US in the map popup, with
+      // a card and DX-life's own convention as evidence. Allowing it at `bundle:RULE` would also have
+      // silenced any FUTURE operative en-US anywhere in that bundle -- clearing a column by going
+      // blind. A `bundle:RULE:file` key exempts the one file that earned it and leaves the rest of the
+      // bundle answerable.
+      const allowed = ALLOW[`${b}:${r.id}:${relative(ROOT, f)}`] || ALLOW[`${b}:${r.id}`]
       if (allowed) { if (matrix[b][r.prop] === 'ok') matrix[b][r.prop] = 'allowed'; continue }
       findings.push({ b, rule: r.id, prop: r.prop, warn: !!r.warn, where: `${relative(ROOT, f)}:${lineOf(src, idx)}`, text: src.slice(idx, idx + 70).replace(/\s+/g, ' ').trim() })
       matrix[b][r.prop] = r.warn ? (matrix[b][r.prop] === 'BYPASS' ? 'BYPASS' : 'warn') : 'BYPASS'