D53 built + live-proven (08 §10 [DESIGN — built]); R-1297 decoys: register-shape decoys assert the script's exit

- 08 §10: built (controller 5bd03ad, hub 7e57e824, commit only); putback_pending as on the wire; as-built notes
- audits/d53-held-apps-2026-10-26: live proof on 9202 against a test hub (3-min grace), red-proofs, teardown
- R-1291 BUILT (not released); R-1298 filed (9202's orphan holds + PrivateBin leftover)
- test_gate_decoys.py: the register-shape cases also run the script and assert its exit code — R-1297's decoy 2
  showed an inert main() passed every case (9 cases red with it now)
- audits/r1297-ci-trim-2026-10-26: runners, times, decoys

scripts/test_gate_decoys.py

@@ -882,7 +882,15 @@ def _rsg_case(name, text, must_convict, expect_rule=None):
             fh.write(text)
         rows, ids, bad = _rsg.check(fp)
         convicted = bool(bad)
-        if convicted != must_convict:
+        # 2026-10-26 (R-1297 A's decoy): the RUNNER calls the script, not check(). An inert main() (convicting
+        # nothing) passed every case here while check() still worked — so the script's own exit code is
+        # asserted too, on every case.
+        _p = subprocess.run([sys.executable, os.path.join(ROOT, "scripts", "register_shape_gate.py"), fp],
+                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        if _p.returncode != (1 if must_convict else 0):
+            fails.append("register-shape [%s]: the SCRIPT exited %d, want %d — check() and the entry point disagree"
+                         % (name, _p.returncode, 1 if must_convict else 0))
+        elif convicted != must_convict:
             fails.append("register-shape [%s]: expected %s, got %s (%s)"
                          % (name, "CONVICT" if must_convict else "PASS",
                             "CONVICT" if convicted else "PASS",