Q03 review findings (low), folded in

(i) tools/source_set.py, which decides which files count as source, is now pinned in the gate together with build.py and rebuild_from_source.py; the gate also re-hashes the Q03 independent report. (ii) The d guard cannot see code that leaves sympy symbolics. This covers a pure-Python term walk that identifies $d$ by name (comparing with == d is already refused by the p22 guard), a str/srepr rename followed by a re-parse, and raw dense-list evaluation. The probes in certificates/Q04_guard_scan.json show these do bypass the runtime guard, and they cannot be closed at runtime. The class is closed by policy: an AST static scan of every package file (code/q0*/*.py; the guard probe files are exempt) forbids the escape primitives, and the gate requires the scan to be clean.