fix: clear main's second red — bug-corpus audit, plus the report it never printed

Three defects, found because the trust gate was red on main for a reason
unrelated to the `local` repair:

1. Bug 063 was filed without a BUG_TEST_MAP / SKIP_BUGS entry, so the audit
   failed closed — correctly. Registered as OPEN with the repro summary.

2. Bugs 053 and 056 still read "OPEN" in the audit after being fixed by R-0005
   and R-0436. Both now name their gate and mutations, so the audit describes
   the corpus rather than a past state of it.

3. run_tests.sh captured the audit with a bare `audit_out=$(...)`. The script
   runs under `set -e`, so a failing audit killed it AT THAT ASSIGNMENT — before
   the block that exists specifically to print every audited bug. The trust gate
   reported failure with the section header and nothing after it: the one
   diagnostic written for this path could never run. Now `|| audit_exit=$?`.

   Verified by removing the 063 entry again: the gate prints the full audit and
   names `FAIL 063_... -- no entry in BUG_TEST_MAP`, where before it printed
   nothing at all. Same family as the `| head` SIGPIPE bug commented directly
   below it — careful failure reporting that the shell disposes of first.

Trust gate now exits 0.

Author: unbalancedparentheses

scripts/tests/audit_bug_corpus.sh

@@ -81,14 +81,16 @@ declare -A SKIP_BUGS=(
   [046]="FIXED by parallel session -- HashMap keys()/values()/elements() Copy-bounded (25510e5e); same finding as this audit's keys/values double-free"
   [049]="OPEN -- reduce --predicate crash is vacuous (parse-only); reduces any program to ~empty, fix pending"
   [052]="OPEN -- T_destroy no-op for arrays; Vec<[T;N]>.drop() skips element destruction (arrdrop cell-count repro)"
-  [053]="OPEN -- DCE deletes checked negations; discard(-x) at MIN loses the trap (tA_neg_dce)"
+  [053]="FIXED (R-0005) -- the unary trap inventory moved into IntArith (evalIntUnaryOp / unaryOpCanTrap) so DCE stops deciding locally whether -x can trap; gated by check_trap_inventory.sh (12 checks, both paths at i8/i16/i32/Int) with mutations #25-#27"
   [054]="HALF CLOSED -- the collision now fails closed with E0809 (a specialization whose mangled name is declared, or two instantiations mangling to one name); gated in check_mono_name_collision.sh. Still OPEN: the mangling is forgeable, so a legitimate program spelling Box_Int is refused rather than compiled, and fn symbols are uncovered (R-0007)"
   [055]="OPEN -- project sibling import alias emits undefined callee (one044); fully-qualified form works"
-  [056]="OPEN -- reassigning a fn-pointer local across a branch emits a phi over Lower's @fnref.X sentinel (E0709); valid program refused, interp runs it. Pre-existing, confirmed on e1b3844e"
+  [056]="FIXED (R-0436) -- a function reference became SVal.fnRef and a call target became SCallee.direct/.indirect, retiring both string encodings; gated by check_fnptr_values.sh (17 checks: rebinding across if/loop, phi mixing loaded register with known global, devirtualization preserved, verifier still refusing undefined phi operands AND undefined indirect targets) with mutations #28-#30"
   [058]="OPEN -- #[proof_by] with no #[proof_fingerprint] compares the current fingerprint with ITSELF, so an edited body still reports proved (R-0004 defect 1; reproducer in the bug doc, control case with a fingerprint stales correctly)"
   [059]="OPEN -- bodyFingerprint drops declared types and never sees the signature: i32 -> u32 keeps a proof proved WITH a stored fingerprint (R-0004 defect 2)"
   [060]="OPEN -- #[requires]/#[ensures] are outside the fingerprint: changing a TRUE postcondition to a FALSE one still reports proved (R-0004 defect 3)"
   [061]="OPEN (latent, no reachable witness) -- PExpr.call spells a parameter application and a global call identically; filed under principle 12 because the proof model is where soundness claims live. The FINGERPRINT distinguishes them (call vs callptr)"
+  [063]="OPEN -- cap-variable inference records \"unknown argument type\" as \"no capabilities\", so a fn pointer read from a struct field, call result or array element cannot reach a cap C parameter; misreported as E0220 against a with() the program never wrote. Rejected-valid-program today, but the authority check already passes on the fabricated empty capset and only expectTy stops it (repro table in the bug doc; no fixture yet)"
+  [063]="OPEN -- cap-variable inference records \"unknown argument type\" as \"no capabilities\", so a fn pointer read from a struct field, call result or array element cannot reach a cap C parameter; misreported as E0220 against a with() the program never wrote. Rejected-valid-program today, but the authority check already passes on the fabricated empty capset and only expectTy stops it (repro table in the bug doc; no fixture yet)"
   [062]="OPEN -- a stale proof does not invalidate dependents: 'mid' depends DIRECTLY on a stale 'leaf' and still reports proved, and 'top' two hops up shows nothing. staleDeps is recorded but never consulted by deriveObligationStatus (R-0004 defect 4; broader than the roadmap description)"
   [039]="FIXED -- regress_039_import_alias_collision/src/main.con (project test, exit 0); emitSModule puts the module's own bare->qualified import aliases ahead of the program-wide pool"
   [040]="FIXED -- regress_040_match_binder_types.con (run_ok 42); CoreCheck addVar shadows (prepend) + match-arm binders arm-scoped (save/restore)"

scripts/tests/run_tests.sh

@@ -7501,8 +7501,14 @@ fi # end section: query
 if section_active bugaudit; then
 echo ""
 echo "=== Bug-to-regression corpus audit ==="
-audit_out=$(bash "$ROOT_DIR/scripts/tests/audit_bug_corpus.sh" 2>&1)
-audit_exit=$?
+# `|| audit_exit=$?`, not a bare capture: this script runs under `set -e`, so a
+# failing audit killed run_tests.sh AT THIS ASSIGNMENT — before the code below
+# that exists specifically to print every audited bug. The trust gate reported
+# failure with the section header and nothing after it, so the one diagnostic
+# designed for this path never ran. Same family as the `| head` SIGPIPE bug
+# noted below: careful failure reporting that the shell disposes of first.
+audit_exit=0
+audit_out=$(bash "$ROOT_DIR/scripts/tests/audit_bug_corpus.sh" 2>&1) || audit_exit=$?
 # Count pass/fail from audit output
 audit_pass=$(grep <<<"$audit_out" -c "^  ok " || true)
 audit_fail=$(grep <<<"$audit_out" -c "^  FAIL" || true)