test: derive paid touchfiles from each eval's static closure (E)

touchfiles.test.ts now checks, per key, that the paid file's static
test/helpers and test/fixtures closure (plus fixture paths it names in string
literals) is covered, and names the file, path, chain and key to fix when it is
not. Free *.test.ts files are no longer touchfiles, so editing a free replay
test stops selecting paid evals: 950 entries removed, 653 real closure paths
added. The hand-copied inventories go: periodic-fixture-selection,
fake-impeccable-touchfiles and 45 per-file selection examples. Selection for
the sample edits (plan-eng-review template, claude-pty-runner,
plan-count-fixture, gstack-config) loses no case under either profile.
CONTRIBUTING documents the rule and its lower bound.

test/third-party-actions.test.ts

@@ -26,7 +26,6 @@ import { generateThirdPartyActions } from "../scripts/resolvers/third-party-acti
 import { generateAsideSetup } from "../scripts/resolvers/aside";
 import { HOST_PATHS } from "../scripts/resolvers/types";
 import { asideDriveOptions } from './helpers/third-party-actions';
-import { E2E_TOUCHFILES, selectTests } from './helpers/touchfiles';
 import recoveryFixture from './fixtures/third-party-actions-recovery-public.json';
 
 const ROOT = path.resolve(import.meta.dir, "..");
@@ -41,12 +40,6 @@ const ctx = {
 const section = generateThirdPartyActions(ctx);
 
 describe('consent offer extraction', () => {
-  test('helper changes select the consent gate evals', () => {
-    expect(selectTests(['test/helpers/third-party-actions.ts'], E2E_TOUCHFILES, []).selected.sort()).toEqual([
-      'tpa-absent-darwin', 'tpa-absent-linux', 'tpa-apple-ban', 'tpa-broken', 'tpa-present',
-    ]);
-  });
-
   test('an unavailable-option explanation is not an offer', () => {
     expect(asideDriveOptions(`B) I drive it in gstack's own visible browser
 C) Manual instructions