test(04-04): the BA7/BA8 drift gates + the search-tree GEO3 pin + the destination-preload capture leg

- BA7: the shipped JS must carry EVERY committed gazetteer id (the
  web half of bot/web id-set parity, T-04-39) — RED against the
  pre-gazetteer bundle, green after the resolver lands in the build
- BA8: the shipped JS carries NO deep-link crypto (JS assets only —
  the official Telegram SDK is external, D-11/T-04-40)
- no-storage: explicit web/src/search memory-only + no-crypto pin
- capture.mjs: the ARAHARAH-DEST signal race + the 'dest' wait mode
  (state=resolved asserted, then the rendered card's text is waited
  on — the card mounts at live, T-04-42) + the shell-dest-preload
  leg; 8/8 expected captures

web/test/no-storage.test.mjs

@@ -12,7 +12,7 @@
  * tokens appear — code occurrences only.
  */
 import { strict as assert } from "node:assert";
-import { readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { test } from "./harness.mjs";
@@ -77,3 +77,28 @@ test("GEO3 web/src/session/store.ts assigns nothing to any storage object (the D
   // ...and keeps the named TTL constant the client revalidates against (D-03).
   assert.ok(code.includes("SESSION_TTL_SECONDS = 900"), "the 900s TTL mirror by name is present");
 });
+
+test("GEO3 web/src/search/ holds no persistence surface and no deep-link crypto", () => {
+  // The ONBD-02 tree (04-04): the resolved destination is user context and
+  // stays MEMORY-ONLY (GEO-03/D-07), and the deep-link path is a plain
+  // public id with NO crypto (D-11). The whole-tree GEO3 gate above already
+  // walks this directory; this explicit case pins the new tree + the
+  // no-crypto law so a future file there fails HERE, by name.
+  const searchDir = path.join(SRC, "search");
+  assert.ok(existsSync(searchDir), "web/src/search exists (the ONBD-02 resolver tree)");
+  for (const file of listFiles(searchDir, [".ts"])) {
+    const code = codeText(file);
+    for (const banned of BANNED) {
+      assert.ok(
+        !code.includes(banned),
+        `${path.relative(process.cwd(), file)} references ${banned} — GEO-03 violated (web/src/search must stay memory-only)`,
+      );
+    }
+    for (const token of ["createHmac", "crypto.subtle", "sha256"]) {
+      assert.ok(
+        !code.includes(token),
+        `${path.relative(process.cwd(), file)} references ${token} — D-11 forbids crypto in the deep-link path`,
+      );
+    }
+  }
+});