Require a token for writes and quarantine what nobody vouches for

Sixteen mutating routes now refuse a caller who cannot present the token the
server started with; queries stay open, because a question is not a write. The
environment variable is ELY_EYE_AUTH_TOKEN, following the repo's env_prefix
convention — the shorter name I reached for first returned 403 where the smoke
expected 401, and the server printed the reason.

Words from a stranger are quarantined on the way in: an HTTP upload is
third_party by definition, and a sentence carrying an instruction-shaped phrase
is quarantined whoever wrote it. A quarantined atom stays findable and stays out
of the compiled context until a second, live, unquarantined source agrees with
its rarest words. Corroboration is computed at read time because it is a
property of the corpus now, not of the moment a memory was written; it is
term-level, and the docstring says so.

forget now erases the source row and the compiled contexts beside the atoms, so
a forgotten memory leaves nothing that can still speak. The semantic cache key
carries a store revision, which fixes a real staleness: a context compiled
before new evidence arrived kept its old quarantine decision forever.

bench.audit --product still pointed at evals.py, which the p1-6 split moved into
backend/src/ely_eye/proofs/. It failed fast, but the anti-self-justification
rule had quietly stopped auditing the product; it now walks the package, and a
test pins that the package exists and holds no re-roll.

Gates: pytest 306 passed; ruff clean; mypy cold cache 24 errors in 9 files, the
recorded baseline, net zero; pyright 0 errors on the 23 backend files and the 2
bench files; go build/vet/test and gofmt clean; npm run build 221.39 kB with
eslint exit 0; bench/filesize_check clean; bench.audit --product clean over 31
harness files; scripts/mcp_write_smoke.sh PASS with the gate live across two
servers and the MCP child.

bench/tests/test_audit.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+from pathlib import Path
 from typing import Any
 
 import pytest
@@ -11,6 +12,7 @@ from bench.audit import (
     best_of_violations,
     frozen_counts,
     injected_cases,
+    product_sources,
     report_violations,
     scorer_is_independent,
     third_party_origins,
@@ -43,6 +45,20 @@ def test_a_plain_data_loop_is_not_flagged() -> None:
     assert best_of_violations(HONEST, "runner.py") == []
 
 
+def test_the_product_audit_reads_the_package_that_holds_the_proof_suite() -> None:
+    sources = product_sources(Path(__file__).resolve().parents[2])
+    assert any(path.name == "suite.py" for path in sources), "the auditor must read the real suite"
+    for path in sources:
+        assert best_of_violations(path.read_text(encoding="utf-8"), path.name) == [], (
+            f"{path.name} re-rolls until a score clears"
+        )
+
+
+def test_a_missing_proof_package_is_refused(tmp_path: Path) -> None:
+    with pytest.raises(SystemExit, match="proof suite"):
+        product_sources(tmp_path)
+
+
 def test_an_explicit_best_of_name_is_flagged_wherever_it_appears() -> None:
     assert best_of_violations("best_of_8 = max(scores)", "x.py")
     assert best_of_violations("def until_pass(self): ...", "x.py")