docs/THREATS.md cites the tests that already prove its walls, and its gap count is the true one #3027

Some rows say none yet though a test exists: the git hook → forge internal call is proven refused without x-forge-hook-secret in test/crew-sandbox.test.ts (~line 407).

Done looks like:

• [ ] Every Test: none yet bullet and none yet table cell in docs/THREATS.md is checked against test/; where a test proves it, the file is cited.
• [ ] Where none does, the line stays none yet (no test is written in this pull).
• [ ] test/threats-doc.test.ts passes and the pull says the gap count before and after.

Files: docs/THREATS.md only. Risk: cite only a test that would fail if the wall fell.