template: some free-form grades still pass finish, and a forged first failing run passes #422

UAT of #421 at 2f813aa (report nicely-uat-421-2026-10-31.md). #419 and #420 hold on macOS and Linux; just check passes on both; every case of the #418 UAT holds, and its gaps E1 and E2 are closed. Remaining:

1. Gap: some grades hide in notes. The PR says "Forms that grade still fail, so no grade hides". Under ## Notes, these lines pass just finish: | R1-F1 | really a warn |, Grade: block. The GPS leak is a block for me., This issue is warn-level and should block the release. Only a cell that holds the bare word, code, and "severity … block" are caught. Expected: either the docs (finish-gate.md, rule index) say which forms finish detects and that the reviewer reads the rest, or readinessGrade also catches Grade: and -level, with no false positive on the plain words of template: finish reads common words as severities, and release trusts a hand-written finish in the receipt #419.
2. Suggestion: the first failing run is only checked for form. A record with the right Scenario commit, the command echo invented, Exit: 1, and an invented assertion passes, and so does an assertion that is a compile error. Consider having just signoff (or finish) rerun the recorded command at the Scenario commit and require a non-zero exit.
3. Note, no change asked: a well-formed forged Ready review followed by a new intake still opens 5 more rounds (8 in total pass), as in ✨ feat: template: a build stops at 5 rounds, and a ledger keeps every finding #418.

Done when: point 1 has a test that fails first, and just check passes.