Correct the p2-4 record against what the reviewer measured

Round one of the p2-4 review found the behaviour sound and the record wrong
in eight places. All eight are fixed here, each against a measurement:

D1  "compare_digest" was written as if it covered holder tokens. It does not:
    the store keeps only a sha256 digest, so verify_token is SQL equality;
    compare_digest guards the operator's plaintext (api_auth.py:54, :110).
D2  register_minimal is called at memory.py:94, not :120.
D3  the compiler cache key never had an "as_holder or ''" step — the old key
    had no identity component at all, which is a stronger defect than the one
    I described.
D4  browse.py's own comment said four copies, two here. There are five, three
    here (:52, :66, :93), which is what test_visibility_rule asserts.
D5  the store_search / vector_index line pointers moved with the as_of work.
D6  my review prompt said 33 routes; measured 34 decorators / 31 distinct
    paths at the parent, 38 / 35 at the reviewed commit.
D7  the semgrep claim cannot be re-run in this container (neither semgrep nor
    opengrep is installed), so it is recorded as an observation from the p0-1
    gate run, and the anti-drift job is given to the test that does not need
    that tool.
D8  "a holder can only write as itself, now guaranteed by the token" is the
    opposite of what runs: only the operator writes, attribution comes from
    default_holder, and the real guarantee is that RememberRequest has no
    holder field.

Four precision notes are recorded too: a revoked token is a hard 401 rather
than a downgrade to anonymous, an anonymous caller passing an empty ?holder=
gets 403, the capability card also carries newest_memory timestamps and
token_issued, and leg_check's commit line is the cwd's HEAD.

The p2-3 entry gains the as_of gap the key test exposed, and the final-accept
entry now carries the seven measured scenarios with the two reasons it stays
open: scenario 7 unmeasured, and recall@10 0.863 against a 0.90 bar.

backend/src/ely_eye/browse.py

@@ -11,7 +11,7 @@ from .retrieval import decode_cursor, encode_cursor
 from .schemas import AtomPage, Modality
 from .storage import ObjectStore
 
-# The visibility rule is spelled out in four literal statements — two here, one in store_search, one in vector_index — because the SQL gate rejects a concatenated statement and a view cannot take a parameter; backend/tests/test_visibility_rule.py fails if the copies disagree.
+# The visibility rule is spelled out in five literal statements — three here, one in store_search, one in vector_index — because the SQL gate rejects a concatenated statement and a view cannot take a parameter; backend/tests/test_visibility_rule.py fails if the copies disagree.
 
 
 @dataclass(frozen=True)