fix(reset): include documents/postings/ in the documents scope

/reset's preview, delete block, and scope description all skipped
documents/postings/ - the drop folder for hand-pasted posting text,
documented in documents/README.md and protected as personal data by
security_guards.py - and then asserted "The documents/ folder is now
empty." The new test derives the folder list from the git tree, so any
future drop folder fails it until /reset covers it. Review finding F26
(2026-08-19).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -56,6 +56,13 @@ per-file diff commands.
 
 ### Fixed
 
+- **`/reset documents` now clears `documents/postings/`** - the drop folder for
+  hand-pasted job posting text was absent from the preview, the delete block, and the
+  user-facing scope description, after which the command told the user "The `documents/`
+  folder is now empty" - false whenever postings were present, and they are exactly the
+  personal residue a reset exists to clear. A new `tests/test_reset_command.py` derives
+  the folder list from the git tree, so any future drop folder fails the test until
+  `/reset` covers it.
 - **`convert_salary_excel.py` no longer corrupts US/UK-formatted numbers 1000x** - the
   both-separators branch always assumed European locale, so a `"1,234.56"` cell was
   silently converted to `1.23456` and written into `salary_data.json`. The rule is now