fix(ci): close capability races and green audit

RUSTREWRITE.md

@@ -364,7 +364,7 @@ The test-suite gate is complete only when:
 - no production method contains real behavior beyond what is required to make
   signatures and constants compile.
 
-### 3.3 Fixed controlled-red baseline
+### 3.3 Fixed compatibility baseline
 
 Milestone 03 closes against the pinned 1,289-invocation catalog, not the older
 1,295 source-text estimate. The six-case difference is intentional: five
@@ -374,21 +374,22 @@ tests that NUnit never runs.
 
 `tests/red-suite-baseline.json` fixes the machine-checked ledger at 1,266
 ordinary translations, 19 live-grid translations, four benchmarks, and zero
-pending, drifted, duplicate, missing, or unreviewed cases. Run the controlled
+pending, drifted, duplicate, missing, or unreviewed cases. The historical
+red-suite filename is retained for automation compatibility, but the reviewed
+Rust translations and benchmarks are now required to pass. Run the controlled
 audit with:
 
 ```sh
 python3 tools/audit_red_suite.py
 ```
 
-With all three live-grid credentials present, the baseline executes every case:
-22 tests pass, 1,287 fail at 131 standardized C# member IDs, and none are
-ignored. Twenty passes are gate/support tests. The only two passing parity cases
-verify the required `BAKED_TEXTURE_COUNT` constant and composable validation
-flags; they do not represent implemented production behavior. Without complete
-credentials, the same audit conditionally ignores exactly the 19 live-grid
-cases and requires the remaining 1,268 parity failures to retain standardized
-member IDs. Production crates remain the failure-only milestone-02 shims.
+Without the explicit live-grid opt-in, the audit requires all 1,266 ordinary
+translations and four benchmark cases to pass, conditionally ignores exactly
+the 19 live-grid cases, and pins the independently counted support-test total.
+Setting `RUN_LIVE_TESTS=1` with all three live-grid credentials makes those 19
+cases required passes as well. Any ordinary failure, unexpected ignore,
+nonstandard failure, parity-catalog drift, or support-test-count drift fails the
+audit.
 
 ## 4. Validated Rust dependency map