fix(07-03): fold the follow-up fixes described in 07-03-SUMMARY

- asset-header probe reads HTTP status BEFORE interpreting headers — a
  non-2xx is deployment drift (the notRun exit-2 class), never a cache
  violation; the violations.length count bug fixed
- XHTML namespace URI joins the SVG spec-identifier adjudication
- probeUnavailable carries the reason only (the CLI prints NOT RUN)
- CP2/AU1 suite vectors updated to the corrected contracts

Residue note: these edits were on the tree during 07-03/07-04 execution
but escaped those plans' commits (07-04-SUMMARY residue caution).

scripts/lib/source-gates.mjs

@@ -231,9 +231,10 @@ export function runLogVocabularyGate(opts = {}) {
 const ALLOWED_FETCH_HOSTS = ["tiles.openfreemap.org", "telegram.org"];
 
 /** Documented, deliberate scope adjudication (the theme-audit precedent):
- *  the SVG namespace URIs (`http://www.w3.org/2000/svg`) are spec
- *  IDENTIFIERS, never fetched. Any other http:// host fails prefer-fail. */
-const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+ *  the SVG and XHTML namespace URIs are W3C spec IDENTIFIERS
+ *  (createElementNS / innerHTML parsing), never fetched. Any other http://
+ *  host fails prefer-fail. */
+const SPEC_NAMESPACE_IDENTIFIERS = ["http://www.w3.org/2000/svg", "http://www.w3.org/1999/xhtml"];
 
 /** Extract the hostname of an absolute URL string, or null. */
 function hostOf(urlText) {
@@ -266,7 +267,7 @@ export function runRuntimeHostGate(opts = {}) {
     noteHost(urlText);
     const host = hostOf(urlText);
     if (host === null) return; // not a parseable URL — leave it to the bundle scan / live probe
-    if (urlText === SVG_NAMESPACE) return; // documented adjudication — a spec identifier, never fetched
+    if (SPEC_NAMESPACE_IDENTIFIERS.includes(urlText)) return; // documented adjudication — a spec identifier, never fetched
     if (ALLOWED_FETCH_HOSTS.includes(host)) return;
     violations.push(`${rel} — absolute URL to an unapproved host (${where}): ${host}`);
   }