test(rest): census what an absent execution context means at all 72 resolveExecCtx consumers (#13213)

Every row is DRIVEN — the mounted handler is called under two wirings of one
instrument (an absent context, and an entitled one) and the decision is read
off the response, never off the grep shape. The site reached by each driven
route is read off the stack, so the route-to-site correspondence is observed
rather than transcribed.

Measured:
  - all 52 bare sites read an absent context as the ANONYMOUS SUBJECT and
    refuse 401 UNAUTHENTICATED, each with a same-instrument positive control;
  - the metadata umbrella refuses the same on every non-carve-out /meta route;
  - with the umbrella isolated, six inner sites do not refuse on their own
    reading (single-guarded) while six do (double-guarded);
  - the public-audience carve-out — the one production path where a swallowed
    context reaches a consumer — is fail-CLOSED at the item read and the tree,
    and fail-CLOSED by FILTERING at the list, where a 200 with an empty body is
    the refusal.

Two corrections to the thread's counts, both re-derived from the tree:
the caught/bare split is 20/52, not 16/52 (four sites spell the catch on the
continuation line and a single-line grep misses them, which is why 16+52 does
not reach 72); and all 52 bare sites are guarded by enforceAuth on the very
next line while none of the 20 caught ones is — the inverse of the reason the
thread gave for doing the bare half first.

No behaviour change: one new test file.


Claude-Session: https://claude.ai/code/session_01TvqBFLRzXdSPcbusDoED9k

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: os-trump