test(client): the envelope-caller census names the string-literal trap in its own failure text

The census walks the workspace for four SDK spellings and blanks COMMENTS
only, deliberately: a scanner that also blanked literals would open a
phantom comment on any block-comment opener inside a string and shrink the
census in silence. The price is that example code quoted inside a literal --
a refusal message showing an author what to write, a usage banner, a fixture
embedded in a gate script -- counts as a real call site. That happened, and
the merge queue ejected the PR.

What made it expensive was never the count; it was the failure text. It read
`expected 21 to be 19` and said nothing about strings, masking or gate
scripts, in a package the author had not edited, naming a ledger the author
had never read, at the most expensive point in the pipeline.

So the count is untouched and the message explains itself. Every assertion
that compares a census-derived number now carries a note that re-reads the
counted sites and says which of them sit inside a literal -- with file, line,
receiver, the opening delimiter and the line that delimiter opened on -- plus
where the repair belongs and what must not be done to make it green.

Strictly additive:

- the literal question is answered by `scanSource`, the pass `maskComments`
  is itself built on, which already reports a per-character `literal` flag
  beside the `comment` flag. No second private scanner, and `maskComments`
  and `js-comment-mask.mjs` are untouched;
- the note is built only while a message is being built, over the counted
  sites alone, and decides nothing;
- it cannot throw: an unreadable file, a stale offset and a garbage site all
  degrade to "not in a literal", pinned in section 6;
- the negative half is pinned too -- a real call site outside any literal
  produces the note that says the trap is NOT the cause, so the positive
  reading stays worth acting on.

`scanCallSites`' per-file matching is lifted out unchanged as
`sitesInSource` so section 6 drives THE MATCHER THAT COUNTS over its
fixtures rather than a copy of it. Every fixture is assembled from parts,
because this file is inside the tree the census walks and a fixture spelled
as one literal would arm the very trap it documents; the last test pins this
file at zero counted sites.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude