- SA1-5: each source gate returns {id, pass, evidence}, passes the current
tree, and FAILS a synthetic violation via injected fixture roots
- BG1-2: production web/dist only; missing build is notRun (never a pass)
- CP1-2: probeUnavailable exact shape + credentials-absent degradation
- AU1-3: CLI exit 0/1/2 — CLEAN on this tree, FAILED on a fixture root
(PRIVACY_AUDIT_ROOT), NOT RUN for --live without credentials