fix(asvs): refuse an abbreviated anchor SHA — checkout reads a short ref as a branch name

[wshallwshall]

actions/checkout resolves ref: as a branch or tag name unless it is the full
40-character hash. An abbreviated anchor_commit therefore died with

A branch or tag with the name '8f01cef8' could not be found

emitted only after it had run git branch --list --remote origin/8f01cef8 and
git tag --list 8f01cef8 — neither of which is what the field means.

check_pinning now refuses anything that is not [0-9a-f]{40}, so it is caught at
authoring time instead of in CI. Two tests; the negative one was proved red first.

Why this is worth a PR rather than a one-line data fix

Fourth instance of one defect in this tool in a day, and all four are the same
statement — the gate failed for a reason having nothing to do with the property it
claims to measure:

drift gate	compared against a CI-injected SHA → could never pass
engine checkout	bare SHA without full history → could never resolve
anchor commit	pinned to a branch-only commit → died when the branch went
anchor commit	abbreviated → read as a branch name

I wrote the invariant that names this class today, in this tool's own docstrings, and
then shipped four violations of it. The discipline is not enforceable by attention —
every one was caught by CI going red. Refusing the short SHA moves this one from
caught late to cannot be written.

Verification

ruff check · ruff format --check · mypy --strict · 26/26 tests pass.
Consumed by the vault gate, which is green on the paired change.

[wshallwshall]

Second commit added to this branch (689b3762), which the title no longer covers — flagging rather than letting it ride in quietly.

fix(asvs): an absence claim must prove its pattern CAN fire, not just that it is quiet

The V5 sweep authored every absence claim in the chapter as a prose narration of a shell command — pattern = "rg -n 'tar.extractall' messagefoundry/ -> exit 1 (zero hits)" — where the field wanted tar\.extractall\(. The field's type is str; prose is a valid str. The shape permitted it and only a detector caught it.

mutation is now required: the realistic reintroduction the pattern claims to exclude, which the pattern must actually match. Prose cannot fire on its own stated reintroduction, so it becomes unwritable rather than merely detectable. Checked before the corpus, so a live positive control cannot launder a pattern that could never have matched.

Worth knowing before merge — this is not yet live, by design. The vault gate checks out the engine at anchor_commit and runs scorecard.py from that checkout, so the new check does not take effect until the anchor moves. That is deliberate: 47 existing absence claims have no mutation, and this grandfathers none of them. They have to be authored — not generated — before the anchor advances past this commit. I'll do that backfill after the V8/V14 sweep supplies its own.

The reason for no default is in the docstring and worth repeating: deriving mutation from pattern would make the check vacuous by construction — a value generated from the thing it validates always satisfies it, so it would pass forever on every claim including the prose ones, while looking like the strongest check in the file. Same defect class it closes, arriving through the fix.

Both new tests proved red first by neutering only the new guard, so they fail for the stated reason rather than because the module stopped importing.