fix(885): cite the predecessor by description, not by a sha the rebase orphaned

Three docstrings dated their measurement to `59003d5a3`, this branch's head before
it was rebased onto `main` after ersatztv#907 landed. That commit is unreachable
from the branch and will never be in `main`, so `git show` on it fails for every
later reader — a citation that cannot be followed is worse than none, because it
reads as checkable. Each now names what it measured against ("the predecessor of
this commit", and for the guard, "as it walked `jobs.<id>` only and compared
per-file NAME SETS"), which is what the reader actually needs and what survives
any rebase.

Refs #885

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV

scripts/tests/test_ci_toolchain_image_resolves.py

@@ -299,7 +299,7 @@ def test_a_refusal_with_NO_CHALLENGE_never_claims_a_token_was_obtained(preflight
 
     `probe` enters the token leg on a `401` only, so a registry answering `403` on the first read —
     or a `401` carrying no `Www-Authenticate` — leaves the script with no token having asked for
-    nothing. Measured 2026-09-05 on the predecessor at 59003d5a3, the `403` shape reported "even
+    nothing. Measured 2026-09-05 on the predecessor of this commit, the `403` shape reported "even
     after a Bearer token was obtained", which sends an operator to package visibility on evidence
     that does not exist (`dont-narrate-mechanisms-you-didnt-measure`). The two codes are BOTH driven
     because they take different paths: the challenge-less `401` still enters and abandons the token