test(okf): pin the two boundary classes the new carriers introduced

Probed after 1.3.0 landed, on advisor challenge. Both came back clean --
these pin them so they cannot regress silently.

1. A `- ` item whose text begins with a YAML indicator AND carries a `": "`
   could in principle route into the block-mapping path with a
   half-validated key instead of into `_reject_dangerous_value`. It does
   not: `&anchor id` fails `_KEY_RE` on the key side, so the item falls
   through intact and raises on the indicator. One row each for & * ! %
   backtick, plus the merge key inside an entry.

2. `_consume_block_mapping` ends at a blank line and at column zero, and
   hands an index back to `_consume_block_list`, which hands one back to
   `_parse_flat`. A line orphaned by that boundary -- a `resource:` left
   over from a mapping that closed early -- must RAISE, not be dropped. A
   pointer that vanishes rather than failing is this repo's failure class,
   so it gets a test rather than a probe. Plus the return-index contract:
   a top-level key after a multi-entry list is neither swallowed nor
   re-read as an item.

868 green (was 859), 130/130 classes. Test-only; no source change.

CHANGELOG.md

@@ -53,7 +53,7 @@ scope descriptor a consumer cannot follow at all. A consumer that dereferences
 it must call `okf.validate_resource_url` itself.
 
 No exported surface changed and no detector behaviour or calibration changed.
-Suite 834 → 859 (25 new rows, plus four pre-existing rows updated where this
+Suite 834 → 868 (34 new rows, plus four pre-existing rows updated where this
 release changed the behaviour they pinned); 130/130 classes, 6/6 documented
 gaps hold, 45 limitations, ReDoS sweep 0/152 candidates flagged.