test: the third hermetic pin can actually fail

kimi was right that inline_undo_is_sealed matched itself: it grepped the whole
file for a string that appears inside its own body, so it succeeded on every
tree forever. Their suggested anchoring had the identical flaw for the identical
reason — any literal this function searches for necessarily appears in this
function — which I only found by running their probe and watching the pin stay
green while the behavioural test went red.

So it locates the real check by line number and reads only that block. head -1
takes the site at :202, never this body at :3311.

Driven, since a pin nobody has watched fail is not a pin: deleting the :205
wiring now fails exactly this check, and deleting all three seals fails all
three. That is the third vacuous guard I have written on this branch family;
the comment says why the obvious shapes do not work, so the next person does
not rediscover it a fourth time.

Refs #136

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/cli.sh

@@ -3308,7 +3308,17 @@ check "hermetic: cibox_run() seals the real /usr/local/bin lookup" 0 "" cibox_ru
 # The failed-logout check builds its own env rather than calling undo(), so it
 # needs the same seal — and it is the one that was missed first time round.
 inline_undo_is_sealed() {
-  grep -A 4 'failed logout is loud' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR='
+  # Locate the REAL check by line number and read only its own block. Anchoring
+  # on a string and grepping the whole file cannot work here: any pattern this
+  # function searches for necessarily appears inside this function, so the
+  # search matches itself and can never fail. kimi caught the first version of
+  # that on !137; the anchored second version had the identical flaw for the
+  # identical reason. head -1 takes the real check (~:202), never this body.
+  local start end
+  start="$(grep -n 'failed logout is loud' "$0" | head -1 | cut -d: -f1)"
+  [ -n "$start" ] || return 1
+  end=$((start + 5))
+  sed -n "${start},${end}p" "$0" | grep -q RIG_FORGEJO_RUNNER_DIR
 }
 check "hermetic: the hand-rolled undo invocation is sealed too" 0 "" inline_undo_is_sealed