fix(test): audit progress probe expects the post-negative-probe end state

Test-only. The unguarded negative probe (proving an UPDATE without the
source predicate demonstrably overwrites a manual row) flips its sacrificial
block manual -> llm-audit BY DESIGN — the later by-source assertion still
expected two manual rows. v3.5.1 lesson, next variant: vet -tags=integration
catches compile breaks, not test logic; the suite now ran locally against a
real PG18 testcontainer (5/5 subtests green) before this push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: GottZ

go/internal/store/sensitivity_integration_test.go

@@ -185,8 +185,12 @@ func TestSensitivityAudit_Integration(t *testing.T) {
 		if pending != bySource["default"] {
 			t.Errorf("pending=%d != by_source[default]=%d", pending, bySource["default"])
 		}
-		if bySource["llm-audit"] < 1 || bySource["manual"] < 2 {
-			t.Errorf("by_source missing classified rows: %v", bySource)
+		// End state of the private scope after the subtests above: defaultID
+		// got its verdict, probeID was overwritten BY DESIGN by the unguarded
+		// negative probe (manual → llm-audit), manualID alone stays manual.
+		// The foreign-scope block must not appear in private counts.
+		if bySource["llm-audit"] != 2 || bySource["manual"] != 1 || bySource["default"] != 0 {
+			t.Errorf("by_source end state wrong (want llm-audit=2 manual=1 default=0): %v", bySource)
 		}
 	})
 }