fix(gates 16, 60, 65): a comment about the artefact is not the artefact (#422)

[rubenvdlinde]

fix(gates 16, 60, 65): a comment about the artefact is not the artefact (#422)

Three more #415-class false negatives, in the three checkers that read a
REGISTRY, a CONFIG and a TAG rather than a call site. Each was reproduced
first with a fixture whose only evidence lives in a comment.

gate-60 icon-vocabulary
manifest uses ViewDashboardOutline,
icons.js registers only Cog FAIL — 1 icon name(s) NOT registered
+ "// TODO: the dashboard nav row still
// needs this — not wired up yet.
// import ViewDashboardOutline from
// 'vue-material-design-icons/…'" PASS <- the defect
+ registerIcons(icons) named only in
an unprefixed /* */ interior line PASS <- the defect

gate-65 coding-standard-adoption
a fixer config with no autoloader FAIL — fixer-config-missing-autoloader
+ "// TODO: we still need to require
// DIR . '/vendor/autoload.php'
// here. Not done yet." PASS <- the defect

gate-16 spec-coverage
an untagged public method uncovered (a finding)
+ "* TODO: nobody has written @SPEC
openspec/specs/thing/spec.md
for this yet" covered <- the defect

A COMMENTED-OUT IMPORT VOUCHES FOR AN ICON THAT RENDERS BLANK. gate-60 exists
for exactly one failure — CnAppNav resolves an MDI name only through the
registry registerIcons() populates, WITH NO FALLBACK, so an unregistered name
renders nothing at all: no glyph, no console error. The comment saying the
import is "not wired up yet" was the whole evidence that it was.

gate-65's silenced rule exists PRECISELY because a php-cs-fixer fatal reads
exactly like a clean tree: with no autoloader the run dies "Class not found",
and --format=json reports that as ZERO FILES NEEDING CHANGES. The comment
bought a green on the check whose job is to stop a green being bought. The XML
paths in that same module have been protected by strip_xml_comments() from the
start — "a commented-out rule is not a rule" is its own docstring. The fixer
config was the one file it read raw.

MEASURED ON REAL REPOS, BOTH DIRECTIONS.

after/before across procest, opencatalogi, openregister, softwarecatalog,
docudesk and larpingapp: IDENTICAL — no count moves on any of the three.

Agreement is what a dead rig looks like, so each gate was also given a
POSITIVE CONTROL on a real repository, by planting the comment in a copy:

gate-60  larpingapp, +2 comment lines in src/main.js
         origin/main  4 unregistered icons -> 3   (a real one hidden)
         fixed        4 -> 4
gate-65  procest's OWN .php-cs-fixer.dist.php, real require line deleted
         and a TODO naming it added
         origin/main  1 finding -> 0              (blind)
         fixed        1 -> 1
gate-16  docudesk lib/AppInfo/Application.php, one TODO line added
         origin/main  2 findings -> 1             (register() hidden)
         fixed        2 -> 2

⚠️ THE MASK THAT CLOSES gate-60 WOULD, ONE KEYWORD ARGUMENT FURTHER, CLOSE THE
GATE. The evidence there IS a string: the icon name lives in the module
specifier 'vue-material-design-icons/ViewDashboardOutline.vue'. So it uses
js_comment_mask and NOT js_mask(blank_strings=True), and arm 4 of the suite
is what makes a future "strings are not evidence" generalisation go red instead
of reporting every icon in the fleet unregistered. gate-65 keeps literals for
the same reason — require __DIR__ . '/vendor/autoload.php'.

⚠️ gate-16 IS THE BORDERLINE ONE, AND MEASURING CHANGED THE FIX.
@spec is a docblock marker: unlike every other gate in #422 the evidence
legitimately lives in a comment and a mask would delete it. What was missing is
POSITION — the anchoring gates 47 and 48 have and gate 46 still lacks. The
first cut was a plain start-anchor. Swept exhaustively over every in-scope
method in the six repos (46,187 judgements, diff scope bypassed so every line
counts as changed) it produced FIVE new findings, all in decidesk's
VotingRoundPanel.vue, all of this shape:

/** Rule enum option lists for the open-round dialog. @spec openspec/specs/voting-system/spec.md */

— a REAL tag in the ordinary PHPDoc order, whose only remedy would have been to
reflow correct documentation. A gate that reddens documented code teaches
authors to stop documenting it, which is the false-positive half of this same
class and the half the survey calls corrosive. The pattern now also admits a
tag FOLLOWING A COMPLETED SENTENCE, which is what the real form is and none of
the prose forms are, and the sweep re-run says ZERO new findings in all six.
The residual hole is stated in the code rather than hidden: a debt sentence
ENDING in a full stop immediately before the tag still counts.

The lead character class was measured too, not guessed: [ \t>*#-] — the
package's markdown standalone lead — would have uncovered 1,264 correctly
tagged methods (626 procest + 638 opencatalogi) written /** @spec … */, so
/ is in the class. And the 109 // @spec openspec/… lines in the fleet turn
out to be unaffected either way, because _docblock_block skips // lines —
the expectation going in was the opposite, and arm 5 records the correction.

TESTS. 14 new arms. Reverted against origin/main — not git checkout --, which
restores the COMMITTED file — six FLIP:

gate-60 arms 2, 3
gate-65 the TODO arm and the removal-note arm
gate-16 arms 1, 2

and eight pass either way and are labelled CONTROLS in their own docstrings,
including gate-16 arm 8, which is the arm that caught the first cut being
wrong, and gate-65's "a real require of a STRING path, below a block comment,
still counts".

Refs #422, #415. Sibling PRs cover the PHP call-site gates and the
runner-inline gates; gate-38 is BLOCKED on #424.