fix(gates 3, 14): a comment is not a route, and a TODO is not a use (#422)

[rubenvdlinde]

fix(gates 3, 14): a comment is not a route, and a TODO is not a use (#422)

Two more #415-class false negatives, both in the RUNNER's own inline greps.
Each was reproduced on origin/main before it was touched, through the gate,
with a fixture whose only evidence is a comment.

gate-14 route-reachability, invariant 1
ThingController::orphanReport(): JSONResponse, no route entry
-> FAIL — rule=missing-route (correct)
the same tree with routes.php gaining ONE LINE
// TODO: wire up 'thing#orphanReport' once the export lands.
-> PASS <- the defect

gate-3 stub-scan, caller-identity arm
public function authorize(string $uid, string $id): bool { … }
with $uid never referenced
-> FAIL — rule=caller-identity-ignored (correct)
the same method with ONE LINE
// TODO: verify $uid actually owns this object before returning true.
-> PASS <- the defect

gate-14's in-code note at that grep says comment hits are "vanishingly rare".
It anticipated the false POSITIVE and missed the false NEGATIVE — the direction
in which the endpoint 404s at runtime and the gate says the route exists.
gate-3's arm exists BECAUSE the builder's fix-mode wrote methods that accept a
caller identity and ignore it (decidesk#45); a stub that DOCUMENTS what it does
not do was being reported finished.

A THIRD one, found while writing the fixture and not in the survey: a
commented-out 'resources' => [...] block exempted a live controller's whole
CRUD quintet from invariant 1. Written as a control, the revert says it FLIPS.

MEASURED ON REAL REPOS, BOTH DIRECTIONS.

Full runs over procest, opencatalogi, openregister, softwarecatalog,
docudesk and larpingapp, before and after: EVERY COUNT IDENTICAL.

procest         g3=3  g14=0        docudesk    g3=0  g14=12
opencatalogi    g3=0  g14=0        larpingapp  g3=0  g14=0
openregister    g3=0  g14=0        softwarecatalog g3=0 g14=0

Agreement is what a dead rig looks like, so both gates were given a POSITIVE
CONTROL on a real repository — a COPY of docudesk, the one repo with a
non-zero gate-14 baseline, whose 12 genuine findings the copy reproduces:

gate-14  one comment line added to appinfo/routes.php naming
         'portalSigningReceiver#viewDocument' — one of its three real
         missing-route findings on a live controller
           origin/main   12 findings -> 11        (a real one hidden)
           fixed         12 -> 12

gate-3   a stub service method taking $uid and ignoring it
           origin/main  FAIL — 1     fixed  FAIL — 1   (both see it)
         + `// TODO: verify $uid actually owns this report…`
           origin/main  PASS                            (blind)
           fixed        FAIL — 1

⚠️ The gate-3 control is reported in TWO steps on purpose. Step (a) — both
arms FAIL — is not the measurement; it is what makes step (b) one. Read
alone, "1 = 1" looks like "the change did nothing", which is exactly what an
arm that never tested anything also looks like.

⚠️ STRING CONTENTS SURVIVE IN BOTH, AND IN BOTH THEY ARE THE EVIDENCE.
php_mask keeps literals by default and that is not an oversight here:

gate-14 a route name IS the literal 'thing#index' and nothing else.
Blanking literals would not widen this gate, it would delete every
route in the file.
gate-3 PHP INTERPOLATES "no such user: $uid" — that is a genuine use of
the parameter. Blanking literals would report correct methods as
unfinished stubs. The single-quoted '$uid' that is NOT a use stays
a residual false negative and is #424's; it is the fail-safe
direction for a gate that accuses a method of being unfinished.

Arms 3 and 6 of the new suite go red the moment somebody generalises "strings
are not evidence" across this file.

A MASK THAT CANNOT BE PRODUCED IS NOT A LICENCE TO GRADE RAW TEXT.
Both gates now decline — SKIPPED (wiring) — when source_scope.py is missing or
fails its positive control, rather than falling back to the raw file. A silent
fallback is precisely the false negative being closed and it leaves no log to
notice; this package has found that shape four times (#147, #245, #276, #374).
gate-3's guard fires on the ARM, not the file: without it the gate would print
PASS with one of its four arms switched off. Arm 7 removes source_scope.py from
a copy of the package and asserts both gates decline.

The shared _php_code_copy helper carries its own positive control, once per
run: of // $uid and $uid, exactly ONE must survive. A helper that echoed
its input back would put every caller straight back into the false negative,
which is gate-5's rule (#147, #245) applied to the two gates it had not reached.
It is NOT a second copy of gate-5's _ra_masked_copy — folding gate-5 into it
means re-proving gate-5's suite and belongs in its own change.

Invariant 2 still reads routes.php RAW. Its exposure is the OPPOSITE direction
(a commented-out route name manufacturing a phantom route) and belongs with the
false-positive half, #423. Changing both here would put two independent verdict
changes behind one measurement.

🔴 REPORTED, NOT FIXED: the runner's _php_code_only (~L919) is a line-PREFIX
filter, so an unprefixed interior line of a /* */ block survives it.
Reproduced: a removal note reading "this app used to return
\OCA\OpenRegister\AppHost\Routes::standard($extra) … It no longer does" sets
_HYDRA_APPHOST_ROUTE_TABLE=1 and injects ten canonical route names, exempting
all of them from invariant 1. The comment directly above that helper already
records this class — it says the first cut was raw greps and that a fixture
"was EXEMPTED BY ITS OWN EXPLANATION" — and it was then repaired with a filter
that only handles the comment shape that fixture used. It gates exemptions read
by gates 5, 14, 30 and 56, so it needs its own change and its own before/after.

TESTS. New suite test_gate_3_14_comment_evidence.sh, 9 arms; discovered by
tests/run-helper-suites.sh with no workflow edit. Reverted against origin/main
— via a separate git worktree of origin/main, so SCRIPT_DIR resolves to that
tree's own lib/ — three FLIP (arms 2, 4, 5) and arms 1, 3 and 6 pass either way
and are labelled CONTROLS. Arm 7 is neither: on origin/main neither gate
consults the helper at all, so it exists because the fix creates the dependency.

Refs #422, #415. Sibling PRs cover the PHP call-site gates and the
registry/config gates; gate-38 is BLOCKED on #424 (its fix needs markup
masking, and routing it into source_scope.markup_mask today would close its
comment half and leave the delimiter half armed). gate-30 and gate-1 are
deliberately NOT in this sweep — see the findings note.