fix(tooling): two checkers stopped manufacturing false audit signals

Both defects are parser bugs in tooling, and both were producing a signal the operator sees on every
run. Plan 2026-11-13_062052, implemented as written.

1. `help coverage` WARN was a quote-pairing artefact (every run, always 367/368).
   `newos4-maintain.py:238-239` captured `this._baseWhitelist = [...]` with a regex and then pulled
   `'([^']+)'` out of it. A JS comment inside that array literal contains the apostrophe in "don't"
   (terminal.js:16), which desynchronised pairing: it matched forward to the opening quote of 'ui' and
   the pseudo-command `t work"\n // …` joined the audited set — so a genuine undocumented command was
   indistinguishable from parser debris. Fix: strip `/* */` and `//` before extracting, and keep only
   tokens matching `^[a-z][a-z0-9_-]{0,40}$`. The same shape bug existed for `const internals = [...]`
   and is fixed by the same helper. The WARN list is now single-line (newlines collapsed) so one bad
   token cannot reflow the digest.

   Proven both ways: injected `'zzz-probe-cmd'` into the whitelist -> `WARN: help coverage 367/368 —
   undocumented: zzz-probe-cmd`; reverted (md5 verified) -> `PASS: help coverage 367/367`.

2. Auto-review "still present in shipped code" fired on generic tokens.
   `STEER-20261112-195037-1eed [high] cmds.indexOf is not a function` was approved because
   `identifiers()` kept `indexOf` and `function` (hits: 36 and 74 files) and R4 approved on `any()`
   present token. `isCommand` — the only name that identifies the fault — was never considered, because
   stack frames were not parsed at all. It does not exist anywhere in the tree.

   Fix: JS keywords/builtins/DOM handler names join the skip set; `stack_functions()` extracts frame
   names (dropping `onclick`, `anonymous`, `eval`); R4 now requires a **distinctive** token (>=6 chars,
   present in modules/, not generic); and a stack whose TOP frame is `<anonymous>` is classified as
   generated code (`js-run` / `new Function`), which can never justify "still present in shipped
   source". The bottom `HTMLButtonElement.onclick (…/main.html)` frame proves only that a click
   started it — deciding on "does any frame name a real file" got this wrong once already.

   Proven: `identifiers('cmds.indexOf is not a function')` -> `[]`; `distinctive(['indexOf','function'],
   {...})` -> `[]`; the real report replayed into a fixture reports `nothing provable (1 left for the
   operator)` with **no** decision row written; production dry-run `nothing provable (0 left)`.
   `decisions.jsonl` still carries exactly 1 row for that report (append-only history untouched).

Regression cover: `python3 scripts/newos4-feedback-autoreview.py --self-test` -> 6/6.
maintain: node tests 42/42, help coverage 367/367, result OK.

0 files changed, 0 insertions, 0 deletions