docs(887): two probed non-routes, recorded so they are not re-derived

Hunting a fifth instance of "the pin assumes it is pinning the thing that still decides"
turned up two candidates that look like routes and are not, both measured rather than
argued:

  * `setupFiles` is pinned by NAME while its CONTENT is not, which reads like the
    package.json hole one level down. It is fail-NOISY: `process.exit(0)` at the top of
    `src/setupTests.ts` makes vitest report `121 failed (121)`, not a green.
  * `tsconfig*.json` shapes what `tsc -b` compiles, not what vitest collects.

Recorded because a reader who spots either will otherwise spend the same probe to reach
the same answer — and because the honest residual beside them is the one that IS open: a
dependency's own install script, reached through `npm ci` and `web/package-lock.json`.
That is a supply-chain concern wider than this guard, and it is named rather than claimed
covered.

Refs: #887
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T79beF1Ufid3dXju4yqkF

scripts/tests/test_image_build_delegates_the_spa_suite.py

@@ -74,6 +74,14 @@ another WORKFLOW (a `needs:` edge naming a job called `test` that is not this on
 pinned command invokes (a vite plugin, an npm lifecycle script). Ask of any new pin: what else could
 decide this, and would the pin still match?
 
+Two candidates for that class were probed and are NOT routes, recorded so the next reader does not
+re-derive them. The `setupFiles` entry is pinned by NAME and its CONTENT is not, but a setup file
+that terminates the run is FAIL-NOISY: `process.exit(0)` at the top of `src/setupTests.ts` reports
+`121 failed (121)`, not a green. And `tsconfig*.json` shapes what `tsc -b` compiles, not what vitest
+collects. What remains genuinely unpinned in that direction is a dependency's own install script,
+reached through `npm ci` and `web/package-lock.json` — a supply-chain concern wider than this guard,
+named rather than claimed to be covered.
+
 The cost is stated rather than hidden: a legitimate edit to those command lines reddens this guard
 and its author must update the pin. That is the same deliberate review trigger `KNOWN_GATE_*` uses,
 applied to the two places where a silent change publishes an untested image.