Lint guard: ban runtime-derived origins in auth paths (never built under TERRA-21)

SUCCESSOR TO TERRA-21, filed 2026-08-16 because TERRA-21 shipped different work under this title and closed. See the TITLE/DELIVERABLE MISMATCH event there for why it is not being reopened. The guard described below has never been built. GOAL: a .gitpush-pre.sh assertion that fails the push when an auth path derives an origin at runtime instead of using the pinned production origin. WHY, and it is a regression guard not a fix: terra was swept clean 2026-08-16 by coder-terra-cc - five origin-constructing sites, all pinned. The prompt was mars shipping a live window.location.origin bug. Terra is correct today and nothing stops the next edit from not being. THE CONSTRAINT THAT MAKES THIS NON-TRIVIAL, carried verbatim from TERRA-21: terra has THREE comments that quote window.location.origin precisely to explain why it is NOT used - login/page.tsx:22, auth/callback/route.ts:51, login-card.tsx:90. A naive grep fires on the documentation of the ban. The guard must match code, not comments. See memory remediation-contains-the-mention. WHAT CHANGED SINCE TERRA-21 WAS FILED, and it is the reason this is now cheap: the comment and string stripping machinery already exists in .gitpush-pre.sh as of aac1c77 - offsets preserved for line numbers, four scanners on stripped text, nsf-allow lookups deliberately on ORIGINAL text. Reuse it. Do not write a second stripper; two strippers that can disagree is the failure this repo already documented on the health endpoint. MANDATORY THREE-ARM CONTROL, same as TERRA-21 was held to: (1) real src tree expects zero, (2) scratch copy with a genuine runtime-origin derivation injected in an auth path expects exactly one finding - this is the MUST-FAIL arm, without it the guard can pass by being disabled, (3) scratch copy with the construct only inside a comment expects zero. Arm 2 is not optional; a clean tree returns zero whether the scanner works or is broken. ADD THE CASES TO THE ARMED SELF-TEST, not to a transcript. TERRA-21 shipped a 15-case self-test that runs on every push before the tree is scanned, with a distinct exit code and its own must-fail control. New scanner, new cases in that fixture, both directions. DEFINE "auth path" explicitly in the guard and state the definition in the WI when you take it. Whatever set you choose, the five known origin-constructing sites must be inside it or the guard is scoped around the thing it protects.