Gate finding BN03.final.2ab (Low): the raw-text branch
(`not error and content.startswith("BLOCKED")`) had no test -- every
refusal row was a JSON envelope carrying `error`, so disabling the
branch stayed green. Make the write_guard row the raw "BLOCKED: ..."
string (the shape tools/file_tools_write_guards.py builds before any
envelope); the envelope path stays covered by the terminal rows. The row
goes red when the fallback is removed.
23a20a218d