docs: R-168 SHIPPED, R-29 CLOSED on the demonstrated alarm, R-169 minted

SPIKE-ci-runner-2026-08-02.md: all six probes with method, measurement and ruling; none
STOPped. P2 (stock image has git but no python3) and P6 (a runner that loses its state
re-registers and orphans the old record) changed the design; P5 (a failed run signals
NOTHING) is why the alarm exists at all.

R-168 SHIPPED with its evidence. R-29 CLOSED — on the demonstrated alarm and not on a green
run, as required: the class it opened is answered at both ends, the hook refusing locally and
CI catching a --no-verify bypass and emailing. R-161 noted: its automatic half now exists for
the STATIC gate, while its original scope, the runtime gate, is deliberately still not
automatic and should stay that way.

NEW R-169 (grep established R-168 was the highest in use): CI can only report, because there
is no gate in the road. Making it blocking needs branch protection plus a PR workflow, both
of which change how the operator works — so it is theirs to decide, and the row states the
cost honestly rather than recommending it.

CONTEXT gains S-8 (CI detects, does not block, and why that is structural), S-9 (a detector
that tells no one is not finished, plus the curl and Cloudflare-1010 traps), S-10 (the runner
is unprivileged because DooPlex is Tier 2), S-11 (CI reproduces the sibling layout).

CLAUDE.md gains the rule earned by red-proofing: a go test -run pattern that matches no test
prints ok and exits 0, and an instrument that can silently drop results is not a measurement.

CLAUDE.md

@@ -56,6 +56,13 @@ UI. Package map, helpers, seams, extension points: **`REUSE.md`** (e.g. new even
   (`{{if .Flag}}` around a button/form/script) ships with a render test per branch of the gate —
   handler tests that POST directly prove nothing about reachability. The v0.70.0 ghost-delete was
   fully implemented server-side and fully dead UI because the button sat inside the wrong gate.
+- **A `go test -run` pattern that matches no test prints `ok` and exits 0.** Found 2026-08-02 while
+  red-proofing: `-run TestCustomerUnified` matched nothing in the target file and reported
+  `ok … 0.062s`, which was read as a passing red-proof. **A red-proof that uses `-run` must first
+  prove the filter matched something** (`-v` and look for `=== RUN`). This is the "an absent line is
+  not evidence" rule aimed at the one place a false green costs most — the proof itself. The same
+  class bit twice that day: a `| tail -5` inside a census query silently dropped rows and looked
+  exactly like a real finding. **An instrument that can drop results silently is not a measurement.**
 - **A health check issues no block I/O.** A probe that touches a wedged device enters uninterruptible
   sleep, survives `SIGKILL`, and cannot be recovered until the device returns or the host reboots — so
   `systemctl restart` hangs too. A timeout protects the caller's control flow and nothing else: the