The reporting address was missing its @ and was unusable. The scope
section described an unrelated static-site generator; replace it with
the YAML parsing, validation, and emitting surface that is actually in
scope (malformed-input DoS, misrepresented values, validation as a
trust boundary).
