Test audit 2: close the gate bypass and browser plain-seek test gaps

[tamashi095]

Test audit 2: close the gate bypass and browser plain-seek test gaps

Closes #1724

The 2026-10 test audit's mutation pilot found two tests that look like cover but catch nothing on the path they name. This PR adds real gates for both. No product code changed, and no product defect was found.

What changed

• gate-expander bypass_is_exact_identity_at_all_rates is rewritten in place. It used to render 3 samples at default settings, where the gate is open, so the output was dry whatever the bypass flag said. Now the gate acts on its input (hold 0, a -60 dBFS plateau), and the test also asserts that the unbypassed output is not dry. It is red on the three pilot mutants: the kernel ignores the bypass word, the prepared flag is dropped, and bypass silences the output.
• host-web: a new test, tests::structural_apply::a_plain_session_seek_keeps_and_counts_its_successor_on_the_browser. It is red when the plain session seek skips run_control. Without that bookkeeping, the next submit before the swap fails the host with web.internal.pending_shape. The C ABI already has the equivalent test.
• Not tested: the table-room backpressure branch. No public call sequence reaches it (spec D3, confirmed from the code by the verifier).

Review

An adversarial verifier gave PASS, with a test-value sentence for each test. Its 2 nits are folded in.

Evidence

fmt, clippy -D warnings, the gate-expander and host-web tests, and check-workspace-policy.sh pass locally. Each new gate was confirmed red on its mutant and then reverted.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}