The guard walked the filesystem with rglob, so on the main checkout it
read gitignored working material: tmp/context/** holds `git archive`
exports of pre-retirement revisions, every one of which names the retired
tools legitimately. Fourteen such lines made `pytest` fail on main while
passing in every worktree.

That asymmetry is the part worth recording. A worktree structurally lacks
both of the directories that break this guard - it has no tmp/, and the
nested .claude/worktrees/ only exists under the main checkout - and every
gate run for C6, D5 and D6a was made inside a worktree. The guard could
not see the thing that breaks it from the place we always ran it.

Derive the list from git instead: tracked plus untracked-not-ignored.
Untracked-not-ignored is included deliberately, because a newly written
file is exactly the case this guard exists for and it is usually not
staged yet. Gitignored files become invisible, which is the intent - they
are not the codebase - and that limit is now stated in the docstring
alongside the other one it already cannot see, invocation strings composed
at runtime.

The precedent is in the repo: the caller census added in D6a derives from
git for these same two reasons, and its docstring names both. This guard
predates it and had not learned the lesson.

Teeth verified rather than assumed: a new untracked-not-ignored file
naming a retired invocation turns it red, removing it turns it green, and
a gitignored file leaves it green as documented.

Gates on the main checkout: 2705 passed / 1 skipped (was 1 failed), ruff
clean, phase0 anchor ic 0.9600 / annual 0.8408, 32/32 configs, frozen
baseline 77/77.