fix(gate-7): a delegated authentication check is not an authorization guard

[rubenvdlinde]

The blind spot

#365 established that if ($user === null) { return 401; } is
authentication, not authorisation, and stopped it clearing a method when
written inline. The same clause one call-hop away — behind a helper whose
name merely begins with require/ensure/check — still cleared the method
on the helper's name alone.

Two independent paths let an unguarded id through:

1. _GUARD_BODY_RE / _HELPER_GUARD_BODY_RE matched
   ->require*(, ->ensure*(, ->check*( by shape. requireUserOr401(),
   checkLoggedIn(), ensureAuthenticated() all matched — every one of them
   an authentication check.
2. The OpenRegister-RBAC clear (Pattern 2b/4c) assumed that a collaborator
   reaching ObjectService is RBAC-guarded. That is only true when the schema
   the collaborator touches actually declares an authorization block —
   and in OpenRegister an absent block leaves the schema open
   (~99.3% of ~1.02M rows, measured previously).

How it was found

decidesk ConflictOfInterestController — three #[NoAdminRequired] routes
take a caller-supplied $id straight into a service with no caller scoping.
Gate-7 reported PASS.

Positive control: a bare IDOR probe was reported; adding only
$this->requireUserOr401(session: $this->userSession); silenced it. So the
gate could see the shape — the helper name was doing the clearing.

Confirmed the assumption is unsound rather than merely unproven: the
conflict-of-interest schema declares no authorization block
(has authorization block: False).

The fix

• Auth-noun negative lookahead on both guard regexes, so
  require/ensure/check + LoggedIn|Login|UserSession|User|Session| Authenticated|Authentication|Auth (optionally Or\d{3}) no longer clears.
  Genuine authorisation spellings — requireOwner, requireUserIsOwner,
  ensureAccess, authorizePermission — still clear, and there is a test
  pinning each one.
• _or_clear_is_credible() gates the deep OR-delegation clear: a class that
  names schema slugs only earns the clear if at least one named schema
  declares authorization in lib/Settings/*register*.json or
  register.d/*.json. A class naming no schema is unchanged (still cleared) —
  the change is deliberately narrow.
  Note it reads source with keep_strings=True; the slug lives in a string
  literal, so the usual comment-stripping pass would erase the evidence.

Measured fleet impact

app	before	after
decidesk	0	15
openregister	0	0
opencatalogi	0	0
openconnector	0	0
pipelinq	0	0

This turns decidesk gate-7 red. The 15 are real findings, not noise: 3 in
ConflictOfInterestController (being fixed now), plus
BoardEvaluationController 3, EIDASSignatureController 3,
EngagementController 1, IntegrationController 1,
ParticipationBudgetController 2, ParticipationController 1,
ProxyVoteController 1. No other app in the fleet moves.

Tests

171 passed — 169 pre-existing plus 2 new, covering both directions: an
authentication-only helper must be reported, and the four genuine
authorisation spellings must still clear. A gate fix without a test proving
the gate can fail is exactly what let this through in the first place.