fix(ci+test): the DAST closure guard matched inside INCOMPLETE, and the doc-guard list omitted it

[wshallwshall]

main is currently red. This is the fix, plus the reason it will not recur. Three defects, each with
its own fix -- none alone is the whole answer.

1. The guard read a negation as an affirmation

The closure-claim pattern had no word boundary before the verb group:

(pen ?test|penetration test|independen\w*).{0,60}(complete|satisfied|closed|covered|discharg)

complete therefore matches inside INCOMPLETE. A ledger sentence asserting the exact opposite
of a closure tripped a guard whose purpose is to catch closure claims. The same hole accepts
uncovered, unsatisfied and undisclosed -- each a word whose meaning is the negation of the verb
being hunted. Adding \b loses no true positive, because a real closure claim spells the verb as its
own word.

A regression test pins the negation mode using the real failing sentence verbatim -- a fixture
invented to match the fix is not evidence the fix covers the fault.

2. The prose collided with a term of art

Separate from the regex: in a document where independent verification is a term of art, "independent
of the gate" is ambiguous to a human reader, not merely to a matcher. Reworded to "separately from
the gate question".

Doing only the reword leaves a guard that fires on the next person who writes "independent ...
incomplete". Doing only the guard fix leaves a sentence that reads wrong to a careful reader.

The reword is belt-and-braces, not load-bearing, and that is measured so nobody later concludes the
guard fix was unnecessary: the fixed guard does not match the original sentence, still does
match a real closure claim, and a full run with the original wording gives 29 passed.

3. How it reached main -- the list, not the gating

The first diagnosis of this was wrong, and it would have produced the wrong fix. It was recorded as a
missed local step. It was not.

The pre-merge doc-guard step already existed at ci.yml:188, already ungated on docs-only PRs, with
its own minimal [dev] install. It simply did not name tests/test_dast_claims.py.

That is also the entire explanation for an asymmetry that otherwise looks like luck: test_link_resolution
is in the list, so PR #324's link failure was caught pre-merge; the DAST guard was not, so it
reached main. Same blind mode, two outcomes, decided purely by list membership.

The blind mode is worse than a plain gap because of who pays: the failure surfaces on the next PR
that touches code, so it is misattributed to whoever opens it. That happened -- #325 inherited a red its
author had no part in.

A curated allowlist silently omits, and nothing in a green run says "a doc guard exists that I did not
run." The step now states the rule in place: when adding a doc-scanning module anywhere in tests/,
add it here in the same commit, and confirm it runs on [dev] with no extras.

Two supporting changes, both about the step being able to lie:

• The list was written twice -- once for the printf, once for pytest -- so the step's own "print
  what you scanned" defence could drift and print a module it did not run, or run one it did not print.
  A defence implemented by duplication defeats itself. One DOC_GUARDS variable now feeds both.
• Every named module must exist. A path typo would otherwise error on an unknown file, or -- under a
  future -k/--ignore form -- silently scan nothing and read as a pass.

The list is not claimed complete. A grep for doc-ish test modules over-counts (it flags
test_push_guard and test_required_contexts, which are not doc guards), and separating the rest needs
reading. An honest partial plus a stated rule beats a number nobody trusts.

Scope and verification

Touches tests/test_dast_claims.py, .github/workflows/ci.yml, and one docs/BACKLOG.md sentence. No
product code.

The proof is unplanted. The new list was run against pristine main, which still carries the real
defect: 1 failed, 209 passed. The guard caught the live fault rather than an invented fixture.

Mutation control run twice. The first attempt armed the mutation through a heredoc, which collapsed the
backslash in the boundary token; the replace matched nothing and the tests "passed" over unmutated code
-- indistinguishable from a surviving mutation. An occurrence assertion refused the no-op rather than
reporting a pass. Re-armed from a written file: boundary removed, the regression test fails; boundary
restored, 18 passed. test_dast_claims and test_link_resolution both pass locally: 29 passed. YAML
parses and the doc-guard step is intact with the list appearing exactly once.