three more register rows: the observations gate refused a report that filed none

R-454 five gofmt-unclean internal/web test files at the BASELINE, with no gate
that would ever notice; R-455 DooPlex has no Docker Hub login and the
unauthenticated ceiling now blocks a BUILD, not just the catalog's resolvability
gate; R-456 a partly-dead stack is not a boot orphan and that rule exists in no
document, so this session re-derived it by watching a repair not happen.

All three were observations in felhom-controller/REPORT.md, which is overwritten
every session. The controller's observations gate refused the push until each one
either named a row or declared itself not a finding - which is exactly its job.

REPORT.md

@@ -29,7 +29,7 @@
 
 ## Register
 
-**194 rows before, 202 after.** Nothing closed, and that is stated rather than implied: R-438 and
+**194 rows before, 205 after.** Nothing closed, and that is stated rather than implied: R-438 and
 R-440 are **amended and stay OPEN** — the mechanism is now documented, not changed — so nothing moved
 to `CLOSED-ITEMS.md` and that file is untouched.
 
@@ -43,6 +43,9 @@ to `CLOSED-ITEMS.md` and that file is untouched.
 | R-451 | slice 7 — a fleet sweep (needs a hub change: no image field is reported) | READY, P3-LOW |
 | R-452 | no gate enforces `catalog_since` (`--depth 1` has no parent to diff) | READY, P3-LOW |
 | R-453 | **the vaulted dashboard password is stale on BOTH demo boxes** | **WAITING-ON-OPERATOR**, P2-MEDIUM |
+| R-454 | five `gofmt`-unclean `internal/web` test files, and no gate notices | READY, P3-LOW |
+| R-455 | **DooPlex has no Docker Hub login — the ceiling now blocks BUILDS, not just gates** | **WAITING-ON-OPERATOR**, P2-MEDIUM |
+| R-456 | a partly-dead stack is not a boot orphan, and that rule is written down nowhere | READY, P3-LOW |
 
 ## Live validation