test(dogfood): the census re-anchors rest-server.ts's enforceAuth control 61 -> 64 for three comment-only mentions (#23580)

Fixes #23563
Clause-②: no

The hourly full run's `Dogfood Regression Gate (3/3)` is red on `main`
at `packages/qa/dogfood/test/authz-probe-blind-spot.test.ts:88`:
`control "enforceAuth" moved in packages/rest/src/rest-server.ts:
expected 64 to be 61`. This PR re-anchors that one control by the
census's own rule for a moved positive control, with a provenance note.
It does not drop, narrow or relax it.

## What changed

One file: `packages/qa/dogfood/test/authz-probe-blind-spot.census.ts`,
on the `rest-server.ts` row only.

- `controls.enforceAuth`: `61` -> `64`. It stays an exact count, not a
range or a floor.
- A provenance paragraph after the `[#23050 slice 1]` one, in the same
voice as the earlier moves (`[commit cc837db]` 61 -> 64, `[#20102]` 64
-> 56, `[#23050 slice 1]` 57 -> 61). It says the control was
RE-ANCHORED, not relaxed, and names the three comment-only mentions by
line.

Not touched: `packages/rest/**` (the comments #23541 added stay as
written), the test runner, every other row and control, and the census's
counting rule. The census states that `occurrences` counts the bare
term, comments included. Its earlier moves were re-anchored under that
rule, so this is a re-anchor, not a rule change.

## Measurements (H1 to H4 from the dispatch)

Every count below comes from the census's own `deriveProbeFileCensus()`,
imported from the checkout named and run with `tsx`. None is a grep of
my own.

**H1: only comments moved. Confirmed.**

| tree | `enforceAuth` (derived / recorded) |
|---|---|
| `8226755ee9` (last green hourly run; parent of `1d79556766`) | 61 / 61
|
| `1d79556766` (PR #23541, #23367) | 64 / 61 |
| `fa6a6085c` (this branch's base) | 64 / 61 |

`git show 1d79556 -- packages/rest/src/rest-server.ts` adds exactly
three lines that spell `enforceAuth` and removes none.
`data-action-routes.ts`, the row's second file, is not in that commit.
The three lines, at `fa6a6085c`:

- `rest-server.ts:2395`, docblock on `apiKeyLifecycleRefusals`: "by
{@link computeExecCtx}'s catch so {@link enforceAuth} can answer it."
- `rest-server.ts:2397`, the same docblock: "identity fault: every door
that never reaches `enforceAuth` keeps the"
- `rest-server.ts:3471`, an inline `//` comment in `computeExecCtx`'s
outer `catch` (declared at `:3044`): "for `enforceAuth`, which answers
its `403` and code."

All three are comments. The same commit also changed `enforceAuth`'s own
body (the lifecycle-refusal answer) and its docblock, but none of those
lines spells the term. It added no call site, forwarder or interface
member. No commit between `8226755ee9` and `fa6a6085c` other than
`1d79556766` touches either file the row reads.

**H2: nothing else on the row moved. Confirmed.** At `fa6a6085c`,
`population` 70 / `reachable` 19 / `blindSpot` 51 match the record. So
do the other six controls: `private register*Endpoints(` 16,
`this.routeManager.register(` 63, `data-action-routes.ts:
this.routeManager.register(` 9, `registerPerItemRoute(` 8, `const
registerPerItemRoute =` 1, `forwarder slice:
this.routeManager.register(` 1. Every other census row also reads as
pinned (0 rows moved).

**H3: red before, green after, locally.** The dogfood shards skip on
`pull_request` and `merge_group` (`ci.yml`, the `dogfood` job's `if:`),
so this PR's CI will not run this test. These two local runs are the
measurement of record. Both ran through `scripts/pm/os-verify-lock.sh`,
with `pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2
test/authz-probe-blind-spot.test.ts`.

Before, on `fa6a6085c` (clean tree):

```text
 FAIL  |isolated| test/authz-probe-blind-spot.test.ts > authz probe blind-spot census (#13260) > packages/rest/src/rest-server.ts — every positive control is still present in THAT file
AssertionError: control "enforceAuth" moved in packages/rest/src/rest-server.ts: expected 64 to be 61 // Object.is equality
 ❯ test/authz-probe-blind-spot.test.ts:88:76
 Test Files  1 failed (1)
      Tests  1 failed | 46 passed (47)
os-verify-lock: VERDICT command-exit 1 · held the lock 3s · waited 0s
```

After, on `11d842198` (this PR's head):

```text
 Test Files  1 passed (1)
      Tests  47 passed (47)
os-verify-lock: VERDICT command-exit 0 · held the lock 2s · waited 0s
```

**H4: the next move in flight. Measured, and it does not move this
control.** At PR #23571's head `3dd76b2a8` (branch
`claude/issue-23491-patch-data-request-gate`, merge base `086fa4640f`,
which already contains `1d79556766`), the census reads `enforceAuth` 64,
the same as the value re-anchored here. Its `rest-server.ts` diff (+41 /
-17) adds and removes no line that spells the term. Every other control
and figure on the row also reads as pinned there. That PR was not
touched.

## Gates

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` at `11d842198` derives 47 commands for the
one changed path. All 47 ran locally, each recorded with its exit code
captured before any pipe:

- 43 exited 0.
- 4 exited 3 (PREREQUISITE NOT MET: they load built `dist/` across the
workspace, and this worktree has no workspace build). These are NOT
MEASURED locally: `check:dts-closure`, `check:dual-build-cjs-loads`,
`check:lean-entry-closure` and `check:sourcemap-no-sources-content`.
CI's `Lint & Repo Gates` runs them.
- `--ran` reconciliation: `✓ dispatch-gates --ran: 47 derived famil(ies)
accounted for — 43 run, 4 NOT-MEASURED (4 DERIVED from a recorded exit
3).`

Declared narrowings:

- The dogfood package's full `pnpm test` (the three dogfood shards) was
not run locally. The census module is imported by exactly one file,
`test/authz-probe-blind-spot.test.ts` (`git grep`). That file was run in
full, so the single-file run covers the whole reach of this diff.
- `pnpm --filter @objectstack/dogfood typecheck` is left to CI's
`TypeScript Type Check`, whose PR selection includes the changed
package. The edit is a numeric literal in the row's `controls` record
(typed as a read-only record of string to number), plus comments.
Building the dependency closure would mean 67 packages, 65 of them a
turbo cache MISS on a dry run.

## Changeset

None. `@objectstack/dogfood` is `private: true`, so this diff publishes
nothing from any released package. Under the repo's convention the PR
carries the `skip-changeset` label.

## Acceptance notes

- Observation, not a defect: the census counts `enforceAuth` textually,
comments included, by its own stated rule. Any prose mention added to
`rest-server.ts` or `data-action-routes.ts` therefore moves the control.
Because the dogfood shards skip on PRs and in the merge queue, only the
hourly full run on `main` sees such a move. That is the two-speed design
working as declared. Changing the counting rule is a census redesign,
out of this card's scope. Carrier: none.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01YRp5z4kK6vgYkrdH97ztsy)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts

@@ -631,6 +631,20 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     // carries the move — the host literal's forwarder (`enforceAuth: (...a) =>
     // this.enforceAuth(...a)`, two) and the host interface's member
     // (`enforceAuth: RestServer['enforceAuth']`, two). No call site was added.
+    // [commit 1d79556766] `enforceAuth` 61 -> 64, and nothing else on this row
+    // moved: 70 / 19 / 51 and every other control re-derived unchanged.
+    // ⛔ RE-ANCHORED, not relaxed: PR #23541 (#23367, the API-key lifecycle)
+    // added three PROSE mentions and no call site, and `occurrences` counts the
+    // bare term, comments included. At `fa6a6085c` they are
+    // `rest-server.ts:2395` and `:2397`, the docblock on
+    // `apiKeyLifecycleRefusals` ("so {@link enforceAuth} can answer it",
+    // "every door that never reaches `enforceAuth`"), and `:3471`, the inline
+    // comment in `computeExecCtx`'s outer `catch` ("for `enforceAuth`, which
+    // answers its `403` and code"). The same commit edited `enforceAuth`'s own
+    // body and docblock in lines that do not spell the term, removed no
+    // mention, and left `data-action-routes.ts` untouched. No call site was
+    // added. ⚠️ The dogfood shards skip on PRs and in the merge queue, so this
+    // move was seen only by the hourly full run on `main`.
     controls: {
       'private register*Endpoints(': 16,
       'this.routeManager.register(': 63,
@@ -642,7 +656,7 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
       'registerPerItemRoute(': 8,
       'const registerPerItemRoute =': 1,
       'forwarder slice: this.routeManager.register(': 1,
-      enforceAuth: 61,
+      enforceAuth: 64,
     },
     note:
       'The single non-tripwire probe names ONE registrar of 16. The other 15 can never mint a key: ' +