fix(commands): the removal gate was classified against the wrong root

Found by review after the SUB-WRITE commit, and both defects were in the
template rather than the engine every prediction in the fasit was about.

`--repo` is what a write target is classified AGAINST. The template passed the
SCAN target, and under `--global` that target IS ~/.claude -- so
~/.claude/CLAUDE.md matched `in-repo` and the gate went `silent`. Measured
against the real config: gate silent, scopeClass in-repo, 29 removals applied
with no approval asked. That is the same silent downgrade #62 measured for a
naive .git-upward walk, arriving through a different door, on the one target
this chunk was sequenced behind M-BUG-41 to protect. Every other gated template
already passed `--repo "$PWD"`; this one was the only outlier.

The dry run also could not validate the machine-wide case -- the case that is
mandatory in v1. The gate returned before any file was read, so a dry run there
reported 29 scope-gate refusals and zero checked spans, and the first run able
to find a stale approval would have been the one that writes. A gate guards a
WRITE, and a dry run is not one: `requiresApproval` and the disclosures are
still reported, so the operator is still asked.

The new caller-arm guard was itself red against the corrected template, matching
prose that merely NAMES the CLI. Narrowed to lines that invoke it.

Guards seen red against the original defects: `--repo "<target-path>"` red,
`--repo` omitted red, gate-blocks-dry-run red. Re-dogfooded as the template now
calls it: require-ok / user-scope / 29 spans validated / 0 files written.

Suite 1659 -> 1662/0. Frozen baselines untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017A6vrtPKsVuM4DJ27p7jzw

tests/scanners/subtraction-write.test.mjs

@@ -203,6 +203,36 @@ describe('applySubtraction (filesystem + gate)', () => {
     assert.equal(await readFile(userFile, 'utf-8'), FIXTURE);
   });
 
+  it('P8b — a dry run on a require-ok target validates the spans AND still reports the gate', async () => {
+    // The gate guards a WRITE. A dry run is not one, so refusing it early
+    // bought nothing and cost the thing the dry run exists for: on the
+    // machine-wide target — the mandatory v1 case — the operator would have
+    // been asked to approve a removal whose spans had never been checked, and
+    // the first run that could discover a stale approval would be the one that
+    // writes.
+    const home = join(dir, 'home');
+    const userConfig = join(home, '.claude');
+    await mkdir(userConfig, { recursive: true });
+    const userFile = join(userConfig, 'CLAUDE.md');
+    await writeFile(userFile, FIXTURE, 'utf-8');
+
+    const result = await applySubtraction(
+      [
+        { file: userFile, line: 5, endLine: 5, text: BLOCK_A },
+        { file: userFile, line: 9, endLine: 9, text: '- Not in this file.' },
+      ],
+      { repoRoot: repo, home, dryRun: true },
+    );
+
+    assert.equal(result.requiresApproval, true, 'the gate must still be reported');
+    assert.ok(result.disclosures.length >= 1);
+    assert.equal(result.applied.length, 1, 'the valid span is validated, not refused unseen');
+    assert.equal(result.refused[0].reason, 'block-mismatch', 'the stale one is found HERE, not at write time');
+    assert.equal(result.filesWritten.length, 0);
+    assert.equal(result.backupId, null);
+    assert.equal(await readFile(userFile, 'utf-8'), FIXTURE, 'a dry run writes nothing, gate or no gate');
+  });
+
   it('P9 — the same target proceeds once the scope is explicitly approved', async () => {
     const home = join(dir, 'home');
     const userConfig = join(home, '.claude');