test(remediate-supplychain): adapt regen-gate test to DIRTY provenance stamp

test_allow_dirty_bypass_records_real_sha was genuinely stale under the
M9 #99 mandate (ALLOW_DIRTY over blocking dirt stamps DIRTY-<sha>);
plus a clean-tree bare-SHA pin. Reason in docs/NOTES.md.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_014wevSWHET5eqHNVNTYZ9W

docs/NOTES.md

@@ -336,6 +336,9 @@
 - Incidental: 68 (not 64) shared skills pre-exists in this tree (Waves 2-3 additions); AGENTS.md:46/generator docstring "64" is stale prose — not M9 scope, M10 follow-up candidate.
 - pi-settings diffs in this regen are worktree-path artifacts (`.../remediate-sandbox/...` → `.../remediate-supplychain/...` shellPath), not content changes.
 
+### Test-fix commit (rule 4, own commit after M9 af3e52e)
+- `tests/test_regen_gate.py::test_allow_dirty_bypass_records_real_sha` was genuinely stale under the #99 mandate (ALLOW_DIRTY+blocking dirt now stamps `DIRTY-<sha>` instead of the bare SHA): updated to expect `DIRTY-<head>` plus a new `test_allow_dirty_clean_tree_records_bare_sha` (sanctioned-only strays + flag → bare SHA). One-line reason recorded here per brief rule 4.
+
 ### Catalog-vs-Dockerfile drift (found on-host, fixed in M9)
 - `context7`: catalog `npm:@upstash/[email protected]` vs Dockerfile `4.4.2` → aligned to catalog.
 - `memory`: catalog `npm:@modelcontextprotocol/[email protected]` vs Dockerfile `1.0.0` → aligned to catalog.

tests/test_regen_gate.py

@@ -184,12 +184,24 @@ class TestRegenGate(unittest.TestCase):
         self.assertEqual(out, "")
         self.assertEqual(err, "")
 
-    # Escape hatch unchanged: ALLOW_DIRTY proceeds and records the real SHA.
+    # #99 (fail-closed): ALLOW_DIRTY over blocking dirt proceeds but stamps
+    # an obvious DIRTY-<sha> marker instead of the bare SHA, so generated
+    # provenance can never silently claim a clean checkout it was not built
+    # from (verify-rigs rejects DIRTY-). Genuinely stale vs the M9 mandate;
+    # changed in its own commit per brief rule 4 (one-line reason here).
     def test_allow_dirty_bypass_records_real_sha(self):
         (self.root / "fleet/fleet.yaml").write_text("roles: {changed: true}\n")
         self.write_strays(["scripts/evil-new-helper.py"])
         sha, out, err, code = self.resolve(HERETEK_RIGS_ALLOW_DIRTY="1")
         self.assertEqual(code, None)
+        self.assertEqual(sha, "DIRTY-" + self.head)
+
+    # #99: ALLOW_DIRTY on a clean (or sanctioned-strays-only) tree still
+    # records the bare SHA — the stamp marks uncommitted inputs only.
+    def test_allow_dirty_clean_tree_records_bare_sha(self):
+        self.write_strays(SANCTIONED_STRAYS)
+        sha, out, err, code = self.resolve(HERETEK_RIGS_ALLOW_DIRTY="1")
+        self.assertEqual(code, None)
         self.assertEqual(sha, self.head)
 
     # HANDOFF.md-style tracked edit refuses without the escape hatch.