Make the Guard Prove It Can Fail

The defect class A gate you have never seen go red is a gate you have not tested. On 2026-08-18, four gates across two repositories turned out to have that problem: a mask that returned ALLOW on a cra