test: three guard patterns fixed in one copy while their twins stayed broken #780

The /premerge run on #768 fixed three narrow/vacuous guard patterns. Each has uncompared twins in other files that were not fixed, because the wave contract confines each agent to one file. Every one was reported by the agent that fixed the first copy — this is the "one contract, N uncompared copies" class (#370/#371), caught by the mechanism working, not by luck.

Disjoint from #769–#777, which cover the files #768 actually touched.

1. Same-line-only tools: frontmatter regex

re.search(r'(?m)^tools:[ \t]*(.+)$', block) requires the value on the same line, so a valid YAML block sequence (tools: then indented - Read) reads as no declaration at all — and "no declaration" means the loader grants every tool (#749). The row would red a correctly-restricted card.

Fixed in tests/testers-agent-contract.test.sh (hoisted to one shared extractor recognising both spellings, with accept/reject rows). Still narrow in:

• tests/orchestrator-plan-flatten.test.sh:97 and :181
• tests/cluster.test.sh:154 and :160 (grep form)

2. Unpinned sort/comm detector blind to non-whitespace terminators

grep -nE '(^|[^=[:alnum:]_./-])(sort|comm)[[:space:]]' requires whitespace after the command, so … | sort), sort|, and end-of-line invocations are invisible — the guard prints PASS on exactly the locale-collation bypass it exists to catch.

Fixed in tests/goal.test.sh:4861 (tail widened to ([[:space:])|;&<>\]|$), plus a G56.mutation-bare` row proving the two pre-existing flag-spelled mutants were structurally blind to it). Still narrow in:

• tests/review-pr-consolidate.test.sh:920 (rcx15_unpinned)
• tests/premerge.test.sh:702 (P17/[finding] plugins/uberdev/skills/premerge-pipeline/SKILL.md:909 — Both scope guards feed comm -23 from sort -u output with #706 fence scan) — a third copy, which additionally carries the rejected line-level grep -v 'LC_ALL=C' filter

3. core.quotePath / --no-renames on byte-comparing scope guards

A scope guard comparing git diff --name-only output against a raw-UTF-8 path list is defeated two ways: git C-quotes non-ASCII paths by default (correct file reported as a stray), and rename detection reports only the new path (deletion of the old one passes unexamined).

Fixed in all three /premerge scope guards in skills/premerge-pipeline/SKILL.md. plugins/uberdev/lib/review-consolidate.sh is tracked in #771.

Suggested approach: each of the three is a detector whose predicate is duplicated rather than shared. The durable fix is to hoist one definition per pattern and have every reader use it — the shape tests/testers-agent-contract.test.sh now uses — rather than widening N copies in step. A CONTRACT: marker on each hoisted definition would make the next divergence visible.

Related: PR #768