Adversarial suite: flow cases for the inputs mergeDecisionFor assembles (plans, labels, money paths, new modules, size, verdict task) (follow-up to #957) #1019

Follow-up from #957 (adversarial suite cases, part of #707): its "Follow-ups (listed, not done)" and the second review issuecomment-6333173487 (round 3, head fd9893c).

The suite's flow cases don't drive the inputs that the coordinator's mergeDecisionFor assembles itself: plans other than one task's own plan of exact paths, labels, money paths, new top-level modules, size and the verdict's task. The non-flow decide() recomputes newTopLevel, lines and the plan's wait list itself, so a mutant in the flow's copy can't turn a case red (measured, issuecomment-6333173487). The reviewer's mutants below each left the suite green (measured by the reviewer).

• Q4 to Q7, hold.outside-plan, under auth-at-l2: flow cases with a plan listing no files, another task's later plan that lists the file, a plan entry by file name only, and a plan entry with a glob (measured survivors).
• Q8, Q9, hold.high-risk: let flow cases set issue.seen labels and a money_path_source list on the default branch, so labels read from the wrong event and a money-path list read at the PR's head are caught (measured survivors). Today the flow's decide path throws on labels and money paths, so it can't drive them (measured, issuecomment-6333173487).
• Q12, the new-top-level-module hold, and Q13, the size hold: flow cases with seed: false and with a big change (measured survivors; Q13's probe was a large deletion).
• Q19, hold.doubt: a flow case with another task's PASS verdict at the same head (measured survivor; the reviewer rates its realism low).

Fix by design: #860's one pure gate function, shared by the coordinator and the suite, would make the recomputed inputs (Q12, Q13 and the plan wait list) the same code by construction (inferred; not stated by the review). The inputs read through I/O (labels, money paths, which task's plan and verdict) still need flow cases (inferred).

docs/guardrails.md's "Not driven" line already names these as open since #957 round 4 (per the #957 body).