fix(gates 6, 17, 56, 57): a comment naming the call is not the call (#422)

[rubenvdlinde]

fix(gates 6, 17, 56, 57): a comment naming the call is not the call (#422)

Four more instances of the #415 class, all in the FALSE-NEGATIVE direction:
the gate looks for a positive signal — a call, a class, a method, a line of
logic — and prose containing the words is accepted as the signal. Every one
was reproduced first, with a fixture whose only "evidence" lives in a comment.

gate-6 orphan-auth
an unreferenced requiresChairAuthorization() FAIL — defined-but-never-called
+ "// TODO: we should call
$this->authz->requiresChairAuthorization($uid)
here before advancing. Not done yet." PASS <- the defect

gate-56 register-handler-resolution
handler -> InvoiceGuard::evaluate, no method FAIL — guard-method-not-found
+ "* TODO: implement function evaluate() here" PASS <- the defect
class DELETED, class and method quoted in one
UNINDENTED /* */ removal note PASS <- the defect

gate-57 orphaned-write-capability
an uncalled postInvoice() FAIL — orphaned-write-capability
+ "* TODO: we should call
$this->fooService->postInvoice($id) here" PASS <- the defect
+ "/* returns true; never throws */" in the
SIGNATURE -> reads as abstract, never judged PASS <- the defect

gate-17 redundant-controller
a one-call pass-through FAIL — pass-through
+ an UNPREFIXED interior line of a /* */ block
survives as "significant code" PASS <- the defect
+ a rescue phrase in that block ("requireAdmin()
is handled by middleware") reads as a guard PASS <- the defect

THE SENTENCE THAT SWITCHES EACH GATE OFF IS THE SENTENCE ADMITTING THE DEBT.
gate-6's whole framing is "an unwired guard is identical to no guard", and the
note saying the guard is not wired reported it wired. gate-56's is "a handler
naming a class that is not there fails at runtime", and the note saying the
class was removed closed it.

MEASURED IN THE FLEET, AND IT IS NOT HYPOTHETICAL. Across procest,
opencatalogi, openregister, softwarecatalog, docudesk and larpingapp the
counts move by exactly one — openregister gate-57 7 -> 8:

lib/Service/File/FileOwnershipHandler.php:262
  method=transferFolderOwnershipIfNeeded rule=orphaned-write-capability

Every "caller" of that method in the repository is a comment. Four of them:

FolderManagementHandler.php:221  // TODO: Call $this->fileService->transferFolderOwnershipIfNeeded($folderNode)
FolderManagementHandler.php:312  // TODO: Call ...($objectFolder)
FolderManagementHandler.php:490  // TODO: Call ...($objectFolder)
FolderManagementHandler.php:562  // TODO: Call ...($node)

Folder ownership is not transferred to the OpenRegister system user at any of
the four sites that say it should be, and the gate that exists to find exactly
that reported it reachable BECAUSE the four TODOs named it. Verified by hand;
it is a real finding, not a new false positive.

WHAT THE MASK DOES NOT DO, PER GATE. A wrong recipe repeated at scale is a
defect multiplied at scale, so each gate carries its own anti-widening arms
and each keeps string literals for its own stated reason:

gate-6 routes.php is still read UNMASKED. A routed controller action has
no ->method( anywhere, ever — the router reaches it through the
STRING 'liveTile#validateSource'. Blanking literals in the caller
corpus does not touch that file, but generalising "strings are not
evidence" across this module would put every routed action back to
being reported dead (#290). Arm 7 is what makes that loud.
gate-17 the docblock is still read from the ORIGINAL text: @spec exclude
lives in a comment BY DESIGN and is the author's only correct
remedy.
gate-57 the caller index is deliberately over-permissive because its
fail-safe direction is to SUPPRESS — this gate accuses live code of
being dead, and a verdict acted on deletes working code.
gate-56 a class or function DECLARATION is never spelled inside a literal,
so blanking them would close nothing that is not already closed.

NOT A SIXTH HAND-ROLLED STRIPPER. All four route through
source_scope.php_mask, which already knows #[ opens a PHP 8 ATTRIBUTE and
that // inside 'https://x' opens nothing. gate-57's local
_blank_php_comments — clause-for-clause identical to php_mask — becomes a
call to it, so the fifth dialect in this package is gone rather than joined.

⚠️ FOUND WHILE BUILDING THE FIXTURE, AND IT IS THE FIX OVER-APPLYING.
gate-17's METHOD_HEADER_RE used ^\s*public, and in MULTILINE mode \s
matches \n — so the match could begin at the start of any run of BLANK
LINES above the declaration. Pre-existing and inert (true line 4, reported 3),
until the body was comment-masked: a blanked DOCBLOCK is a run of blank lines,
the reported line slid up into it, _method_docblock walked from the wrong
place, found no */, and a reason-bearing @spec exclude SILENTLY STOPPED
EXEMPTING. Closing a false negative by breaking an author's only correct
remedy is worse than the false negative. Anchored to ^[ \t]*; arm 5 of the
new suite is the arm that caught it.

TESTS. 23 new arms. Reverted against origin/main — not git checkout --,
which restores the COMMITTED file — eleven FLIP:

gate-6 arms 2, 3, 4 (//, /* */, #)
gate-56 arms 2, 3
gate-57 arms 2, 3, 4, 5
gate-17 arms 2, 3 + the blank-line line-number arm

and twelve pass either way and are labelled CONTROLS in their own docstrings,
including the near-miss (gate-17 arm 3b: the same sentence three characters
along never reaches the question, because the ObjectService test short-circuits
before RESCUE_PATTERNS). Saying so is the point — an arm that cannot fail is
not proof that the gate cannot.

gate-17 had NO suite at all before this; test_detect_redundant_controllers.py
is new and tests/run-helper-suites.sh discovers it with no workflow edit.

Refs #422, #415. Sibling PRs cover the runner-inline gates and the
registry/config gates; gate-38 is BLOCKED on #424 (its fix needs markup
masking, and routing it into source_scope.markup_mask today would fix its
comment half and leave the delimiter half armed).