Q07 review fixes

(i) Status relabelled: {evanescent ${\kappa }^3$ three-point defect ${\sigma }_0$-exact at pole level; X non-unique (ghost-equation compatible)}. This supersedes the Q07/Q08 wording “${\sigma }_0$ closure CLOSED at pole level”; the frozen Q07/Q08 certificates are left unchanged. (ii) The Q04 independent rebuild report is bound by its sha256 in the Q09 gate. (iii) A new static scan module (guard_scan3) flags operator.methodcaller in any form and coefficient/exponent walks aimed at $d$ (coeff, as_coeff_exponent, as_independent, collect, as_poly, degree, and dictionary walks of the power/coefficient dictionaries keyed by $d$). All 10 probes are flagged; code/, tools/ and tests/ are clean. The Q05 scan is unchanged; the runtime guard stays primary.