test(forge): the negative half of the github pass-through pins

@grok-reviewer-andresmgsl landed the term-5 pins in ff17d1e while I had the
same two asks in flight locally; theirs is on the branch and I dropped my
duplicate rather than push a competing tip. This adds only what the two
suites did not share.

Their pins are positive: the github twins DO call the right endpoints, and
forge_pr_activity emits all three timestamp sources. Mine had two negatives
they did not, and negatives are what catch the drift a 1:1-extraction path
actually suffers — a positive pin still passes if the github path GAINS
forgejo behaviour, and term 5 is a statement about what must NOT change.

  - the github timeline is never reshaped. That timeline already IS the
    shape ruling.sh selects on, so a projection here would be a second,
    divergent normalizer maintained by nobody.
  - github activity never derives inline comments from reviews. That
    derivation exists on the forgejo path only because the flat endpoint
    404s there; a github twin quietly adopting the workaround is the
    "both backends drift together" failure term 5 forbids.

Mutation-verified: adding a --jq projection to the github timeline, and
swapping the flat PR-comments read for a reviews-derived one, each red their
own case. forge-backends 77 -> 79.

Refs #188

test/forge-backends.test.sh

@@ -436,6 +436,16 @@ check "github forge_timeline paginates the issue timeline endpoint" 0 "" \
   grep -qE 'api --paginate repos/o/r/issues/42/timeline|api repos/o/r/issues/42/timeline' "$gh_calls"
 check "github forge_timeline is a pass-through of the GitHub event shape" 0 "" \
   jq -e '.[0].event == "labeled" and .[0].actor.login == "alice"' <<<"$gh_tl" >/dev/null
+# The NEGATIVE half of "pass-through". A positive pin still passes if the
+# github path GAINS forgejo behaviour, and term 5 is a statement about what
+# must NOT change — so the drift these two catch is the only kind a
+# 1:1-extraction path realistically suffers.
+#
+# The GitHub timeline already IS the shape ruling.sh selects on, so a
+# projection here would be a second, divergent normalizer maintained by
+# nobody.
+check "...and never reshapes it, as the forgejo backend must" 1 "" \
+  grep -q 'issues/42/timeline.*--jq' "$gh_calls"
 : >"$gh_calls"
 gh_act="$(
   forge_select github
@@ -451,6 +461,13 @@ check "github forge_pr_activity hits commits" 0 "" \
   grep -q 'repos/o/r/pulls/9/commits' "$gh_calls"
 check "github forge_pr_activity emits all three timestamp sources" 0 "" \
   test "$(printf '%s\n' "$gh_act")" = "$(printf '%s\n' '2026-08-01T10:00:00Z' '2026-08-01T10:30:00Z' '2026-08-01T11:00:00Z')"
+# The forgejo backend derives inline comments from reviews with
+# comments_count > 0, because the flat endpoint 404s there. That derivation
+# must never appear on this path: GitHub serves the flat endpoint, and a
+# github twin quietly adopting the workaround is the exact "both backends
+# drift together" failure term 5 forbids.
+check "...never deriving them from reviews, as forgejo must" 1 "" \
+  grep -q 'pulls/[0-9]*/reviews' "$gh_calls"
 
 unset -f gh
 . "$ROOT/lib/forge-forgejo.sh"