tools: a missing collaborator is a failure, not a blank

--verify's collaborator loop printed ⚪ and continued on 404 without touching
`ok`, so the one instrument that checks Phase 1.2 could not report Phase 1.2
being undone. An agent removed from the repository read as "nothing to say"
rather than as a gate that is no longer there.

It has never fired: Gitea answers that endpoint with permission "read" for a
non-collaborator rather than 404, so the case was caught by the role test two
lines down. Correct outcome, wrong reason -- the same shape as the check that
passed on an instance with no rule at all, and not worth keeping because the
luck has held so far.

Found by the port agent reading the file rather than running it, which is the
only way this one was ever going to surface.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01McNbzUeq1KRBWs4G6X2YVj

tools/gitea-protect

@@ -172,8 +172,20 @@ def verify(tok):
     # merge, so a green rule proves nothing on its own.
     for agent in AGENTS:
         status, perm = api("GET", f"/collaborators/{agent}/permission", tok)
+        # 🔴 A MISSING COLLABORATOR IS A FAILURE, not a blank. This branch used
+        # to print ⚪ and `continue`, leaving `ok` untouched -- so the one
+        # instrument that checks Phase 1.2 could not report Phase 1.2 being
+        # undone. An agent removed from the repository read as "nothing to say"
+        # rather than as a gate that is no longer there.
+        #
+        # It never actually fired: Gitea answers this endpoint with permission
+        # "read" for a non-collaborator rather than 404, so the case was caught
+        # by the role test below -- by luck, not by design. That is the same
+        # shape as a check that passes on an instance with no rule at all, and
+        # it is not worth keeping just because the luck has held.
         if status == 404:
-            print(f"  ⚪ {agent:<42} not a collaborator (yet)")
+            print(f"  🔴 {agent + ' is not a collaborator':<42} Phase 1.2 is undone")
+            ok = False
             continue
         if status != 200:
             print(f"  🔴 {agent:<42} permission unreadable ({status})")