`scan *.md` only matched the repository root, so a file added under any subdirectory would have stopped being checked without the CI step noticing. Scanning recursively follows the files instead of the layout, and --respect-gitignore keeps it off .venv and .dora.