R-426: hostinstall gate gets decoys; two live holes closed, exemption removed

The R-185 check counted the bare word `felhom-backup-target-apply grant`, so the
dry-run echo stood in for a deleted real grant (2 resolutions, 2 "grants"); now
only path-qualified invocations at a command start count. The age check matched
a commented-out install; now comment lines are excluded. Decoys (plus a version
const in a new hub sub-package, and a comment naming the identifier that must
pass) live in test_gate_decoys.py; all three convicting decoys were seen to PASS
against the pre-fix gate. EXEMPT drops `felhom.eu/hostinstall`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/decoy_coverage_gate.py

@@ -36,9 +36,6 @@ EXEMPT = {
     ("felhom.eu", "one-register"):
         "R-424 — a real defect parked under state `idea` is invisible. Declared in the gate's own "
         "docstring as residual hole 1; the decoy passes today.",
-    ("felhom.eu", "hostinstall"):
-        "R-426 — no plausible decoy constructed yet. It asserts installer invariants against a "
-        "shell script; a legitimate decoy needs a shape a real edit would produce.",
     ("felhom.eu", "due-checks"):
         "R-426 — no legitimate decoy constructed; the attempt in the sweep was a no-op and its "
         "verdict was withdrawn rather than reported.",