test: final coverage pass — CLI rendering, revert traps, keychain probe, gbrain doc ops

The user-directed third generation pass closes the audit's remaining
tail: the code-intelligence CLI's options/status/suggest surfaces get
behavioral coverage through the fake-shim chain; brain-context-load
gains an argv-logging trap that goes red if anyone reverts the memoized
PATH scan back to the spawn probe (receipt: simulated revert failed
exactly these tests); the darwin Keychain auth branch (#1890) gets its
first free-tier tests via a PATH-shimmed security binary; and the gbrain
add/delete/export ops are pinned (body piped byte-for-byte, receipt
sha256, stdin-EOF prompt guard, PROVIDER_UNAVAILABLE degradation) —
retiring their TODOS entry.

TODOS.md

@@ -84,18 +84,6 @@ debug of what the child's preamble actually echoes.
 **Why:** every red periodic run costs triage time; two of these have burned
 three triage passes across two releases. **Effort:** M. **Priority:** P2.
 
-### P3: gbrain-adapter add/delete/export behavioral coverage
-
-**What:** Extend test/code-intelligence.test.ts's fake-gbrain shim to pin the
-three untested capability-advertised ops: add() pipes the body to `put <slug>`
-and writes a receipt with the body's sha256, delete() survives the stdin-EOF
-prompt guard, export() returns stdout, and each degrades to
-PROVIDER_UNAVAILABLE when the CLI is absent.
-
-**Why:** Shipped public ops with zero exercise; the harness to test them
-cheaply already exists. **Effort:** S. **Priority:** P3.
-
-
 ### P1: #1882 — portable skill-install prefix (non-`gstack` install dirs break silently)
 
 **What:** Every generated SKILL.md hardcodes the literal `~/.claude/skills/gstack/...`