test(verify-gate): allow the --no-team sweep exclusion, keep registration banned

setup now legitimately mentions verify-gate once: the --no-team identity
sweep excludes it via GSTACK_SWEEP_EXCLUDE_SOURCES so team-mode teardown
can't delete a user-registered gate. The opt-in pin tightens from a blanket
not-contains to: every mention must be a comment or that exclusion, and no
mention may sit on an add-event line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/verify-gate.test.ts

@@ -349,7 +349,17 @@ describe('opt-in contract (adapted from the fork: NOT registered by default)', (
   const gate = fs.readFileSync(GATE, 'utf-8');
 
   test('./setup does NOT register the gate — a Stop hook running the verify command after every turn is opt-in', () => {
-    expect(setup).not.toContain('verify-gate');
+    // The only permitted mentions are comments and the --no-team sweep
+    // EXCLUSION (protecting a user-registered gate from team-mode teardown).
+    // A registration (add-event) referencing the gate stays banned.
+    const mentions = setup.split('\n').filter((l) => l.includes('verify-gate'));
+    expect(mentions.length).toBeGreaterThan(0);   // the exclusion itself is pinned
+    for (const line of mentions) {
+      const t = line.trim();
+      const allowed = t.startsWith('#') || t.includes('GSTACK_SWEEP_EXCLUDE_SOURCES="verify-gate"');
+      expect(allowed).toBe(true);
+      expect(t).not.toContain('add-event');
+    }
   });
 
   test('the bin documents its own registration and removal commands', () => {