venus pre-push invariant lints cannot see a committed violation, and defer one as soon as its file is dirtied

Two true statements about venus .gitpush-pre.sh after VENUS-476 narrowed its contract. Neither is fixed; neither is covered by the VENUS-103 scope gate. 1. NO STANDING-RED CHECK OVER COMMITTED CONTENT. The VENUS-103 population is staged + unstaged + untracked only. A violation already committed, in a clean file, is not seen at all - not aborted, not deferred, never a finding. Nothing in venus checks committed content for these three invariant families. 2. A COMMITTED VIOLATION DEFERS ONCE SOMETHING DIRTIES ITS FILE. The whole-file checks read file_text(path), so a standing committed violation in e.g. src/app/admin/**/page.tsx becomes visible when an unrelated dirty edit touches that file - and prepush_scope classifies it by path, dirty and outside --only, so it DEFERS. It aborted before 84ecf29. 3. AMPLIFIER: gitpush.sh:517-565. A --only push with nothing staged prints NO NEW COMMIT and still runs git push, publishing every unpushed local commit. A blocked migration already committed outside --only can ship on a push that never names it. A fix needs finding PROVENANCE, not a path-level dirty test: was the violation introduced by the dirty hunk, or is it in the committed blob (git show HEAD:<path>)? The second must keep aborting. That is new capability, which pmmaster explicitly kept out of VENUS-476 - hence a separate row.