Make the command gate machine-independent, and calibrate the budget fallback

CI went red on `1dc1d9b` in both jobs while the identical command passed locally, and the reason is
worth keeping: the checks depended on state that only exists on a developer's machine.

check_commands.py -- the gate's verdict depended on a gitignored directory
  The previous commit's fix recognised a workbench script by matching its name against a walk of
  `tools/`. That tree is gitignored, so a clean checkout has none of it: `dcc.py` matched locally and
  skipped, and on CI nothing matched, it fell through to `missing-script`, and the gate reported
  drift for three quoted lines. A check whose verdict changes with a directory CI does not have is
  not a check. Two changes remove the dependency:

    * `qualified_basenames()` collects every `.py` the *document itself* writes with a path, so a
      bare name the document has already located elsewhere is a skip, computed from the text.
    * `./dcc.py` is a declared upstream entry point, checked before the workbench-name test.
    * a bare name after a `cd` that resolves nowhere is `after-cd-unresolved` -- unverifiable, which
      is not the same claim as broken, and is now reported as such instead of as drift.

  Verified by running the whole CI sequence against a tree with `tools/` hidden: five gates exit 0,
  the suite passes. That experiment is the one that should have been run before the first push.

check_budget.py -- the measurement was installation-dependent
  The gate measures the always-loaded body in tokens, preferring `tiktoken` and falling back to
  `characters / N`. `N` had been guessed at 3.6 rather than calibrated, so a machine with tiktoken
  saw ~11.1k tokens and passed while a machine without it saw ~14.2k and warned -- and CI's 3.11 job
  is the one without it. `N` is now the measured 4.285 characters per token (47,629 chars -> 11,114
  tokens on SKILL.md), both paths agree within one token, and `tests/unit/test_budget_measurement.py`
  forces both paths and asserts they do not straddle the budget.

  CI now installs `tiktoken` so the comparison exercises the real tokenizer instead of skipping.

Also: two `.py` files are formatted for consistency, and the reconstruction record documents the
CI-only failure, since "it passed on my machine" is the lesson rather than an aside.

Gates: check_repo 0 problem, check_refs 0 dangling / 0 warning, check_routing coherent,
check_budget 0 failure / 0 warning (both measurement paths), check_commands 154 checked / 0 drift,
pytest 617 passed on 3.14 and 609 on 3.11.

docs/tool-verification/EXTENSION-reconstruction.md

@@ -299,8 +299,12 @@ middle category is the one worth reading.
 
 **Not reproducible.** `python tests/run_tests.py -q` runs: `run_tests.py` forwards what it is given
 to pytest (`args = list(argv[1:]) or ["-q"]`), and its usage block documents exactly that. `dcc.py`
-is written as `cd tools/_work/bench/repos/dcc` then `python dcc.py ...` — an external checkout, not a
-script this repository ships.
+is an external checkout, not a script this repository ships — the form the record uses is:
+
+```
+$ cd tools/_work/bench/repos/dcc
+$ python ./dcc.py <SAMPLE_DIR>/baseline.apk --no-build --dynamic-register
+```
 
 **Real, and fixed.** Seven commands in two evidence records named a **workbench** script with no path
 at all (`$ python analyze_pair.py`, `b2_measure.py`, `ttd_attach.py`, `make_skeleton.py`). Those files
@@ -322,6 +326,27 @@ a stricter regex but a corrected resolution order plus a corrected classificatio
    tells the reader where to stand, so a bare `python dcc.py` after it is correct. That is skipped as
    `workbench-after-cd`.
 
+### 2.6a The same gate failed on CI and passed locally, and the reason is worth keeping
+
+The first version of the fix above shipped and CI went red on `check_commands.py` — in both the 3.11
+and 3.13 jobs — while the identical command passed on the machine that wrote it. The difference is
+`tools/`: it is gitignored, so a clean checkout does not have it, and **recognition of a workbench
+artifact by filename required the tree to exist**. On the developer's box `dcc.py` matched a name
+under `tools/` and was skipped as `workbench-after-cd`; on CI nothing matched, it fell through to
+`missing-script`, and the gate reported drift for three quoted lines in this very file.
+
+Two lessons, both now enforced rather than remembered:
+
+- **A check whose verdict depends on a gitignored directory is not a check.** The classification is
+  now computed from the **document** as well: `qualified_basenames()` collects every `.py` the text
+  itself writes *with* a path, and a bare name that appears in that set is a shorthand the document
+  already explains — so it skips identically on a clean checkout and on a populated one.
+- **A gate that cannot be run in the same shape as CI will disagree with CI.** Reproduce the CI
+  condition locally before believing a green run: `mv tools /tmp/hidden && python check_commands.py`
+  is the whole experiment, and it takes seconds. That is what found this, after the fix had already
+  been pushed.
+
+
 **Two defects of this pass's own, found while fixing it.** A `--json` run printed the `RESULT=` token
 *after* the JSON document, so `--json | jq` failed with `Extra data`; the token is gone from that path
 and the status is a field in the document instead. And the fix's own substitution left four literal