docs(rules): the mock-lies rule covers every stand-in

[goetchstone]

What and why

The improve-rules pass over everything since 2026-10-01: the fix commits b6feae3, 383100a, 6947456 and
5f8193e, the failure-log entries, the two open ledger entries, and failed CI runs.

Finding: known mode, weak wording. Three of the four fixes share one shape, a test stand-in kinder
than the real thing:

• the in-memory Keychain's delete could not fail, so a refused one read as success (b6feae3);
• every test and the in-memory store used one spelling of a domain, so a capitalized import became a
  second tenant (6947456);
• TestClient and headless Chrome download a CSV that the app's WKWebView displays as a page (5f8193e).

CLAUDE.md's "mock lies" section names only tests/fixtures/mock_gam.sh, so it read as a rule about the
GAM mock. This edit says it covers every stand-in (the Keychain fake, the app window, GAM) and names the
tripwires that hold them to the real thing. Pre-commit item 6 says the same. This also resolves the
2026-10-08 ledger entry, which asked for an app-window corollary.

No new invariant, no renumbering. The ledger records the other verdicts: 383100a and the hook-test
incident were not rules problems, and the 2026-10-02 entry (#3's wording) is the next candidate, since
this PR makes one change.

How it was verified

• .venv/bin/python -m pytest -q passes
• Demonstrated the tripwires the text points to: with the swallow put back in
  _KeyringBackend.delete_password, 11 tests in test_vault.py fail; with download dropped from the
  Audit export link, test_every_link_to_a_download_route_carries_the_download_attribute fails; both
  pass once restored
• make lint / a11y: n/a (docs only)

If it builds or runs a gam command

n/a

Live status: n/a (docs only).

Nothing private

• No credentials, real domain names, real addresses, or captures from a real tenant

🤖 Generated with Claude Code