fix(885): the guard states both invariants, and the second one is executed

The two `docs/guard-inventory.md` rows and the module docstring described
`test_workflow_persist_credentials.py` as the `actions/checkout` guard only. The
deferral to #909 rested on `docs/guard-inventory.md` being held by the session
working #881; that issue is closed and its PR is the commit this branch is rebased
onto, so the file is free and the edit belongs here under docs-update-is-part-of-done.

`MUTATIONS` keys at most one declared clause mutation per guard FILE
(`test_the_manifest_covers_exactly_the_MUTATION_rows` asserts `len(MUTATIONS) ==
len(declared)`), and the grading row's proof-ref column is compared against it, so
the route invariant cannot take a second `MUTATIONS` row. It takes a `CLAIMS` entry
instead — the population #881 widened this file to carry — bound to the inventory
sentence that states it: deleting `build`'s `if: github.event_name != 'pull_request'`
from the shipped `docker-build.yml` is applied to a sandbox copy every run and the
named proof is required to redden with the collector's own wording.

That grows the `CLAIMS` population from three entries to four, which invalidates the
cost span `testing.mutation-claims-are-executed` measured over three. Re-taking it
here produced 54.3s/149.5s, 81.6s/78.7s and 114.3s/84.2s across three A/B pairs with
other builds on the host — two inverted, so the load dominates the signal. The record
now says the span is a lower bound and that a re-measurement is owed on a quiet
machine, rather than carrying a scaled or invented number.

Decisions-Edit: yes
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV

scripts/tests/mutation_manifest.py

@@ -679,4 +679,30 @@ CLAIMS: tuple[Claim, ...] = (
         "The mutation drops `record_wing_faults()` from the call and keeps `yaml_faults`, which is "
         "the deletion the sentence describes rather than a caricature of it.",
     ),
+    Claim(
+        site="docs/guard-inventory.md",
+        quote=(
+            "deleting `build`'s `if: github.event_name != 'pull_request'` from the shipped "
+            "`docker-build.yml` reddens `test_no_PULL_REQUEST_route_job_names_a_STORED_secret`"
+        ),
+        target=".gitea/workflows/docker-build.yml",
+        clause="    if: github.event_name != 'pull_request'",
+        replacement="    # if: clause removed by the mutation harness",
+        proof="test_workflow_persist_credentials.py::test_no_PULL_REQUEST_route_job_names_a_STORED_secret",
+        outcome=RED,
+        expect="job `build` names stored secret(s) on the pull_request route",
+        why="`MUTATIONS` is keyed one entry per GUARD FILE, and "
+        "`scripts/tests/test_workflow_persist_credentials.py` holds TWO invariants since #885 — the "
+        "`actions/checkout` one its declared entry stands for, and the PR-route stored-secret one. "
+        "The second would otherwise have no executed mutation at all, so the inventory row states it "
+        "in prose and the prose is bound here, which is the population #881 widened this file to "
+        "cover. The clause is the ONE thing keeping `build` — the last job naming `REGISTRY_PASSWORD` "
+        "— off the head-authored route, so the mutation is the defect the invariant exists for and "
+        "not a caricature: with it deleted the collector must name that job and that secret. The "
+        "mutation is driven into the SHIPPED workflow rather than a fixture for the same reason the "
+        "module's own two mutation tests are: a synthetic document would only prove the collector "
+        "works on YAML this repo does not run. The declared diagnostic is the fault's own wording "
+        "rather than the assertion's, because a red anywhere else in that test — a parse error, an "
+        "empty population — prints a different message and is evidence about nothing.",
+    ),
 )

scripts/tests/test_workflow_persist_credentials.py

@@ -1,4 +1,9 @@
-"""Every `actions/checkout` drops the persisted credential (ersatztv#835).
+"""TWO credential invariants over one derived workflow population.
+
+Every `actions/checkout` drops the persisted credential (ersatztv#835) — below — and no job
+the `pull_request` trigger reaches, nor the workflow scope outside `jobs:`, names a stored
+secret (ersatztv#885). The second is documented at its own banner further down, where the
+population it adds to this one is derived; what follows here is the first.
 
 WHAT THIS IS PROTECTING. `actions/checkout` writes an `Authorization` header into `.git/config`
 unless `persist-credentials: false` is set, and this instance's Actions default token permission is