fix(885): cite the predecessor by description, not by a sha the rebase orphaned

Three docstrings dated their measurement to `59003d5a3`, this branch's head before
it was rebased onto `main` after ersatztv#907 landed. That commit is unreachable
from the branch and will never be in `main`, so `git show` on it fails for every
later reader — a citation that cannot be followed is worse than none, because it
reads as checkable. Each now names what it measured against ("the predecessor of
this commit", and for the guard, "as it walked `jobs.<id>` only and compared
per-file NAME SETS"), which is what the reader actually needs and what survives
any rebase.

Refs #885

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV

scripts/tests/test_ci_toolchain_image_resolves.py

@@ -299,7 +299,7 @@ def test_a_refusal_with_NO_CHALLENGE_never_claims_a_token_was_obtained(preflight
 
     `probe` enters the token leg on a `401` only, so a registry answering `403` on the first read —
     or a `401` carrying no `Www-Authenticate` — leaves the script with no token having asked for
-    nothing. Measured 2026-09-05 on the predecessor at 59003d5a3, the `403` shape reported "even
+    nothing. Measured 2026-09-05 on the predecessor of this commit, the `403` shape reported "even
     after a Bearer token was obtained", which sends an operator to package visibility on evidence
     that does not exist (`dont-narrate-mechanisms-you-didnt-measure`). The two codes are BOTH driven
     because they take different paths: the challenge-less `401` still enters and abandons the token

scripts/tests/test_workflow_persist_credentials.py

@@ -523,7 +523,8 @@ def test_the_DOCUMENT_walk_finds_every_secret_reference_the_TEXT_does() -> None:
     loader drops) is then a disagreement, and the guard says so instead of reporting clean.
 
     IT COUNTS OCCURRENCES, IT DOES NOT COMPARE NAME SETS, and that is the load-bearing part rather
-    than a refinement. Measured 2026-09-05 on the shipped tree at 59003d5a3: hoisting
+    than a refinement. Measured 2026-09-05 against the predecessor of this commit — the guard as it
+    walked `jobs.<id>` only and compared per-file NAME SETS — hoisting
     `ETV_REGISTRY_AUTH: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}` into
     `docker-build.yml`'s root `env:` left a set-comparison cross-check GREEN (`14 passed`), because
     `build` legitimately keeps naming both names — the two halves cancelled and the check could only
@@ -711,9 +712,9 @@ def test_the_collector_reports_a_WORKFLOW_SCOPE_reference_no_job_if_can_reach()
 def test_MUTATION_a_WORKFLOW_LEVEL_env_in_the_SHIPPED_workflow_is_DETECTED() -> None:
     """Drives the SHIPPED `docker-build.yml`, hoisting the credential to workflow scope.
 
-    This is the mutation that a name-set cross-check could not see (measured 2026-09-05 at
-    59003d5a3: `14 passed`, rc=0) — `build` already names both halves, so a second copy at root
-    changed no NAME. It is exercised on the real file rather than a synthetic document for the same
+    This is the mutation that a name-set cross-check could not see (measured 2026-09-05 against the
+    predecessor of this commit: `14 passed`, rc=0) — `build` already names both halves, so a second
+    copy at root changed no NAME. It is exercised on the real file rather than a synthetic document for the same
     reason `test_MUTATION_the_BUILD_job_losing_its_route_EXCLUSION_is_DETECTED` is: `docker-build.yml`
     is the file the invariant is about, and a fixture would only prove the collector works on a
     document this repo does not ship.