R-426: due-checks gate gets decoys; exemption removed

Four cases in test_gate_decoys.py, planted inside the real DUE-CHECKS block:
an orphaned check whose id survives only in prose, the due-TODAY boundary with
due-tomorrow as the genuine article (today pinned via FELHOM_GATE_TODAY to a
date before every real check), and the block's marker named in prose (exit 2).
Each convicting decoy was seen to PASS under a mutation of the gate (row match
loosened to the bare id; `<=` to `<`; duplicate-marker refusal removed). The
gate itself is unchanged — no hole found. EXEMPT drops `felhom.eu/due-checks`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/decoy_coverage_gate.py

@@ -36,9 +36,6 @@ EXEMPT = {
     ("felhom.eu", "one-register"):
         "R-424 — a real defect parked under state `idea` is invisible. Declared in the gate's own "
         "docstring as residual hole 1; the decoy passes today.",
-    ("felhom.eu", "due-checks"):
-        "R-426 — no legitimate decoy constructed; the attempt in the sweep was a no-op and its "
-        "verdict was withdrawn rather than reported.",
     # felhom-controller
     ("felhom-controller", "docker-v"):
         "COVERED IN THE SWEEP, not yet in a suite: an unallowlisted `-v` host path in a new Go file "