docs(819): mirror the retracted checkout-vs-binary framing into its last copy

Round 15 returned MERGEABLE — no blocker, no HIGH, no MEDIUM, the mechanism
re-verified end to end and residual (6)'s correction measurably true in every
clause. Two LOW prose inaccuracies, both of the two-copy-drift class that has
blocked six rounds, so they are fixed rather than shipped.

`trackedSourceFiles.realgit.test.ts`'s header was the fourth copy of the
checkout-versus-binary framing that `docker/Dockerfile` and `docs/testing.md`
both explicitly retract — the reading that broke the Docker stage once already.
It is also the header a reader consults when changing that exclusion, which is
exactly the scenario the repair was needed for. Measured again here: with `.git`
present and git off `PATH`, the guard still fails with the plugin's refusal, so
it needs a checkout AND, through it, the binary. The realgit pair is the half
that needs the binary and NO checkout.

`docs/guard-inventory.md`'s scope item said "four files" and then named five —
in the paragraph whose whole subject is a hand-written mirror going stale, and
one table down from the FIVE-vs-SIX count the previous commit fixed.

Refs: #819

docs/guard-inventory.md

@@ -64,7 +64,7 @@ with have sat in these gaps. Treat anything not named here as unassessed, not as
    the check proves each job was classified, never that the classification is CORRECT; and an
    `inline` assertion cannot be proven to work without running the job, so those rows carry
    `Proof: NONE` honestly instead of borrowing a neighbouring file's proof.
-2. **C# and TypeScript guards** — four files, none with a row:
+2. **C# and TypeScript guards** — five files, none with a row:
    `ErsatzTV.Mcp.Tests/ToolCatalogTests.cs`, `web/src/api/pageSizeCallSites.guard.test.ts`,
    `web/src/api/completeRequest.guard.test.ts`, and the pair
    `web/vite-plugins/trackedSourceFiles.test.ts` + its `.realgit.test.ts` sibling, which together

web/vite-plugins/trackedSourceFiles.realgit.test.ts

@@ -6,11 +6,15 @@ import { afterAll, describe, expect, it } from 'vitest';
 import { type GitRunner, resolveTrackedSourceFiles } from './trackedSourceFiles';
 
 /**
- * SEPARATE FILE because these are the only tests in the SPA suite that need the `git` BINARY, not
- * merely a checkout (ersatztv#819).
+ * SEPARATE FILE because these are the only tests in the SPA suite that need the `git` BINARY but NO
+ * CHECKOUT — they build their own repository (ersatztv#819). That is not the same as saying the
+ * guard needs only a checkout: it needs a checkout AND, through it, the binary. Measured — with
+ * `.git` present and git off `PATH`, `pageSizeCallSites.guard.test.ts` still fails with the
+ * plugin's refusal. Reading the two exclusions as checkout-versus-binary is what broke the Docker
+ * stage once already; see `docker/Dockerfile`, which retracts that framing.
  *
  * `docker/Dockerfile`'s web-build stage runs on `node:22-bookworm-slim`, which ships no git at all,
- * so this file is excluded there alongside the guard that needs an index. Keeping them apart means
+ * so this file is excluded there alongside the guard. Keeping them apart means
  * that exclusion costs two files rather than the thirteen injected-runner tests in
  * `trackedSourceFiles.test.ts`, which run fine with no git and no repository.
  *