fix(07-03): fold the follow-up fixes described in 07-03-SUMMARY

- asset-header probe reads HTTP status BEFORE interpreting headers — a
  non-2xx is deployment drift (the notRun exit-2 class), never a cache
  violation; the violations.length count bug fixed
- XHTML namespace URI joins the SVG spec-identifier adjudication
- probeUnavailable carries the reason only (the CLI prints NOT RUN)
- CP2/AU1 suite vectors updated to the corrected contracts

Residue note: these edits were on the tree during 07-03/07-04 execution
but escaped those plans' commits (07-04-SUMMARY residue caution).

scripts/test/privacy-audit.test.mjs

@@ -228,11 +228,14 @@ await test("CP2 both live probes degrade to notRun (never throw) without Cloudfl
   const saved = process.env;
   process.env = strippedEnv;
   try {
-    for (const probe of ["runKvExpiryProbe", "runAssetHeaderProbe"]) {
-      const r = await m[probe]();
-      assert.equal(r.pass, false, `${probe} without credentials is pass:false`);
-      assert.equal(r.notRun, true, `${probe} without credentials carries notRun:true`);
-    }
+    const kv = await m.runKvExpiryProbe();
+    assert.equal(kv.pass, false, "kv-expiry without credentials is pass:false");
+    assert.equal(kv.notRun, true, "kv-expiry without credentials carries notRun:true");
+    // asset-headers' unavailable driver is the ORIGIN (not CF creds) — the
+    // empty baseUrl forces the no-origin branch with NO network call.
+    const headers = await m.runAssetHeaderProbe({ baseUrl: "" });
+    assert.equal(headers.pass, false, "asset-headers without an origin is pass:false");
+    assert.equal(headers.notRun, true, "asset-headers without an origin carries notRun:true");
   } finally {
     process.env = saved;
   }
@@ -249,7 +252,7 @@ await test("AU1 the CLI prints per-gate evidence and exits 0 with PRIVACY AUDIT
   for (const gate of ["storage-api", "kv-ttl", "log-vocabulary", "runtime-hosts", "bundle-telemetry"]) {
     assert.match(res.stdout, new RegExp(`^${gate}: PASS —`, "m"), `per-gate evidence line for ${gate}`);
   }
-  assert.match(res.stdout, /kv-expiry: NOT RUN \(pass --live\)/, "a skipped live probe is never silently green");
+  assert.match(res.stdout, /^kv-expiry: NOT RUN — \(pass --live\)$/m, "a skipped live probe is never silently green");
   assert.match(res.stdout, /PRIVACY AUDIT CLEAN/, "the clean summary line");
 });