ci: the preflight repair relocated its blind spot; close it

REVIEW OF THE PREVIOUS COMMIT, NOT NEW MACHINERY. The diagnosis it states was
re-verified in both directions before anything here was written: `dist plan
--tag=v0.1.0-rc2` gets past the tag/version check (stopping at the pinned
cargo-dist-version, as expected) and `--tag=v0.1.0-rc3` reproduces the CI error
verbatim, naming `--tag=v0.1.0-rc2` as the fix in its own help text. The
workflow was never broken. Both claimed fault injections also reproduce exactly:
the comparison replaced by `if false;`, and `expected` derived from the tag, each
produce four failures and exit 1 -- exit code read unpiped, since a pager's
status would mask it.

WHAT THE TEST COULD NOT SEE. Disabling the dirty-tree guard outright left all
six checks green and the script exiting 0. That guard is not decoration: it is
what stops a tag naming a commit that was never tested, and its failure is
irreversible in the same way the version mismatch is.

The cause is the previous repair. Moving the negative cases to a clean throwaway
checkout is what made the tag comparison reachable at all -- and it thereby
removed the only circumstance in which the test could observe the tree guard.
The guard whose PRECEDENCE caused the original vacuity became the one thing the
suite could not see. The vacuity and its repair are not two events; the repair
relocated the blind spot rather than closing it.

So the new check is aimed the other way: a tag that MATCHES the version, run
against a dirtied checkout, so the comparison passes and a refusal can only be
the tree. Verified discriminating -- with the guard disabled it fails with exit
1, and the two faults are independent in both directions (comparison disabled
leaves the tree check passing, guard disabled leaves the three tag checks
passing), so the seventh check is not a restatement of the other six.

Also recorded, rather than guarded: the `dist plan` second opinion can be
disabled with the suite green, because every input the test feeds it has already
been refused by the textual check. That follows from the arm being optional by
design -- pinning it would mean installing a dist matching cargo-dist-version,
the very mismatch the script tolerates on purpose. Stated so the silence is not
mistaken for coverage.

Two corrections of fact. The CI step lives in the `kb` job beside
pr-watch-test.sh, where this repo keeps its check_the_checkers -- not in `test`;
tooling.md now says so. And the awk version parser was probed rather than
hardened: `version.workspace = true` yields empty, which the root path refuses
loudly and the per-crate loop skips; a non-first [package] block and build
metadata both parse correctly; a trailing comment on the version line mis-parses
but fails CLOSED and prints the mis-parsed value in the refusal. No manifest in
this workspace has one, so nothing was changed for it.

No version bumped, no tag cut.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

context/code/tooling.md

@@ -379,3 +379,37 @@ and each produces four failures and exit 1.
 That is `context/design-principles.md` §7's "a check that looks like the answer,
 answering a neighbouring question", found in a checker written to prevent
 exactly that class, within an hour of writing it.
+
+**And the repair opened a second blind spot in the same place — which is the
+more useful half.** Moving the negative cases to a clean checkout is what made
+the tag comparison reachable at all, and it thereby removed the only
+circumstance in which the test could observe the **dirty-tree guard**.
+Disabling that guard outright left all six checks green and the script exiting
+`0`: the guard whose *precedence* caused the original vacuity had become the one
+thing the suite could not see, and the repair's own shape is what hid it. A
+vacuity and its repair are not two events here; the repair relocated the blind
+spot rather than closing it.
+
+The check that closes it is therefore aimed the other way — a tag that
+**matches** the version, run against a dirtied checkout, so the comparison
+passes and a refusal can only be the tree. That is §7's *assert the direction
+the default cannot supply* applied to a **fixture** rather than to a default:
+the clean checkout is the fixture, and the discriminating input is the one that
+makes it dirty. The two faults are independent in both directions — with the
+comparison disabled the dirty-tree check still passes, and with the guard
+disabled the three tag checks still pass — which is what makes the seventh
+check worth having rather than a restatement of the other six.
+
+**What is still unchecked, and why that is a decision.** The `dist plan` second
+opinion can be disabled — its refusal arm rewritten never to match — with the
+suite green, because every input the test feeds it is one the textual check has
+already refused. That follows from the arm's own design rather than being an
+oversight: it runs *after* the primary check, it is allowed to be absent
+entirely, and an absent `dist` already prints that only the textual check ran.
+Pinning it would mean installing a `dist` matching `cargo-dist-version`, which
+is the very mismatch the script tolerates on purpose. Stated here rather than
+guarded, so the next reader does not mistake the silence for coverage.
+
+**Where it runs.** The `kb` job, beside `scripts/pr-watch-test.sh` — this
+repo keeps its check_the_checkers there, not in `test`. The step needs no
+trealla and no nix of its own; it is `sh`, `git archive` and `awk`.