[MG_Remote, CI] (P6/dl): the Fatal census gate, and the one death under MG_Remote that named nothing

Exit gate S7, and the precondition for CONTRACT-P6 5.2's funnel rather than
its replacement.

S7 says "a bare abort() added outside Session::Fail -> the census gate goes
red". Session::Fail does not exist: it is the 93-site refactor 5.2 describes,
and it is not in this commit. What IS checkable today is the property that
funnel exists to guarantee and that every consumer already depends on - every
death under MG_Remote/ names a FAMILY, in a Fatal{Word} marker a grep can
find. run_trace_case.cmake reds a split retrace on any `Fatal{` line, the
retrace lane's refusal census counts them by name, and MEASUREMENTS quotes
the distinct words. A death with no word is invisible to all three.

TWO RULES, BECAUSE ONE WOULD LAUNDER THE OTHER. An abort must carry a marker
within twelve lines; and every WireLogFatal call must carry one in its format
string. WireLog.cpp's own abort is exempt from the first rule ONLY because its
five callers satisfy the second - a funnel that accepted an unmarked string
would be a hole shaped exactly like the rule.

THE BASELINE BOUNDS SILENCE, NOT DEATHS. Abort sites may grow freely; a new
family word may not appear unrecorded. Freezing the total would make every new
guard a gate change, which is how a gate stops being run. The wire's FatalCode
has seven values and the internal vocabulary is thirty-two, which is the
divergence D2 exists to bound - so growing it has to be an act, not an
accident.

THE CENSUS ALSO CORRECTS ITSELF. Its first run reported WireLog.h's own PROSE
as an unmarked death: the comment explaining why the stderr echo exists
contains the words std::abort(). So the scanner strips comments before
matching, with a character-level pass rather than a regex - a `"http://"`
inside a string literal is not a comment - while KEEPING string literals,
because the markers it looks for live in them. Real numbers after that fix:
93 abort sites, 32 family words, 0 unmarked. a6 had counted 92 and 30 from a
scan that did not make the distinction.

AND THE ONE REAL FINDING. a6 named two aborts with no marker at all;
WireLog.cpp's is the sanctioned funnel, so the genuine one is
PersistentMapTracker's invalid-MOBILEGL_IPC_ADOPT_TIER death. It now carries
Fatal{UnimplementedAdoptTier}, which is what makes the census zero.

R-16 both ways, run: a bare std::abort() reds it naming the file and line, and
a new family word reds it naming the word and how to record it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/test.yml

@@ -1984,6 +1984,14 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@v6
 
+      # `dl` / exit gate S7. CHEAP AND EARLY, on a job that only reads the tree: it needs no
+      # build, so a death that names no family is reported in seconds rather than after the
+      # matrix. What it refuses is a std::abort() under MG_Remote/ with no Fatal{Family} marker,
+      # and a family word that appeared without being recorded - the vocabulary drifts on
+      # purpose or not at all (CONTRACT-P6 5.2's D2 ruling).
+      - name: Fatal census (S7)
+        run: python3 scripts/ci/fatal_census.py
+
       - name: Load trace cases
         id: trace-cases
         run: |