Correct the record the second review round measured against

Round 2 found the functional side true and six record/discipline defects.

- D9: the write-path line said "comparison uses secrets.compare_digest" as if
  it covered both tokens. It does not: the operator's plaintext is compared with
  compare_digest (api_auth.py:54, :110), a holder token is SQL equality on its
  sha256 digest (holder_store.verify_token) because no plaintext is stored. The
  boundary is now stated in verify_token's docstring as well as the record.
- D10/D13: three historical numbers were written as if they were current. The
  four-file 59 is pinned to 2ea48d8 (test_trust_quarantine.py was 25 tests there,
  26 from d56996b on), and both 401 gate lines are pinned to the commit they were
  measured on (83dfc14, 89c880f) with the current 406 named next to them.
- D12: the compiler cache-key line overstated one direction. The old key had no
  identity part at all, so whoever compiled first got served to the next caller;
  an empty pack reaching the operator is one direction, not the mechanism.
- D11: the p2-5 acceptance cell's suite count is pinned the same way.
- D14: bench/video_audio_check.py wrote straight into bench/reports/, so a
  reviewer running it in its own worktree would have overwritten frozen
  evidence. It now takes --report/--payload and refuses a destination that
  already holds a frozen report; refuse_frozen_overwrite is tested, along with
  the guards that stop the harness from measuring nothing.

Gates: pytest -q 410 passed; ruff clean; bench.filesize_check OK;
bench.audit --product 33 harness files / 2 reports / 6 set files, clean;
pyright 0 errors on the three touched files; mypy cold cache Success on the same
three.

backend/src/ely_eye/holder_store.py

@@ -121,7 +121,11 @@ class HolderStore:
         return entry
 
     def verify_token(self, token: str) -> str | None:
-        """Which holder a bearer token speaks for, or None when it speaks for nobody."""
+        """Which holder a bearer token speaks for, or None when it speaks for nobody.
+
+        The store keeps only the sha256 digest, so this is SQL equality on the digest: no plaintext
+        exists here to compare in constant time, and a copied database cannot replay a token.
+        """
         if not token:
             return None
         with self.database.connect() as connection: