test: resolution allowlist follows main (webhook_filters, gateway_service_unit, git_credentials, mcp PATHEXT)

Main moved or removed four allowlisted sites and added three.
Updating the rows preserves the ratchet's stale-entry check.

tests/fixtures/resolution_allowlist.json

@@ -89,11 +89,6 @@
     "symbol": "_remux_aac_to_m4a",
     "kind": "bare_which"
   },
-  {
-    "path": "gateway/platforms/webhook_filters.py",
-    "symbol": "WebhookRouteProcessor.run_route_script",
-    "kind": "bare_which"
-  },
   {
     "path": "gateway/platforms/whatsapp_cloud.py",
     "symbol": "<module>",
@@ -134,6 +129,11 @@
     "symbol": "_external_process_spec",
     "kind": "bare_which"
   },
+  {
+    "path": "hermes_cli/cli_session_mixin.py",
+    "symbol": "CLISessionMixin._clear_terminal_on_exit",
+    "kind": "bare_which"
+  },
   {
     "path": "hermes_cli/commands_completion.py",
     "symbol": "SlashCommandCompleter._get_project_files",
@@ -179,11 +179,6 @@
     "symbol": "_safe_which",
     "kind": "bare_which"
   },
-  {
-    "path": "hermes_cli/gateway.py",
-    "symbol": "_append_node_dir_for_service",
-    "kind": "bare_which"
-  },
   {
     "path": "hermes_cli/gateway.py",
     "symbol": "_build_wsl_interop_paths",
@@ -229,6 +224,11 @@
     "symbol": "supports_systemd_services",
     "kind": "bare_which"
   },
+  {
+    "path": "hermes_cli/gateway_service_unit.py",
+    "symbol": "_append_node_dir_for_service",
+    "kind": "bare_which"
+  },
   {
     "path": "hermes_cli/gateway_windows.py",
     "symbol": "_exec_schtasks",
@@ -241,7 +241,7 @@
   },
   {
     "path": "hermes_cli/git_credentials.py",
-    "symbol": "_github_token",
+    "symbol": "_gh_cli_token",
     "kind": "bare_which"
   },
   {
@@ -569,11 +569,6 @@
     "symbol": "_resolve_stdio_command",
     "kind": "bare_which"
   },
-  {
-    "path": "tools/mcp_tool_config.py",
-    "symbol": "_which_with_config_pathext",
-    "kind": "bare_which"
-  },
   {
     "path": "tools/process_registry.py",
     "symbol": "_build_systemd_scope_argv",