v3.3.1 — CI and tests only

A CI-and-tests patch: no tool changes behaviour. If you are on v3.3.0 your tools work the same; take this for a green, honest test suite.

v3.3.0's own CI went red on all three jobs. None was a defect in a tool — each was in how the release was tested:

• The history identifier scan checked nothing on a tagged release commit. Its range started at git describe --tags, which on the release commit is the new tag, so the range was empty and the scan correctly refused to certify it. It now starts from the last tag before HEAD.
• 16 new tests of gate logic never ran on a machine with no X4. They imported a gate that refuses at import without an install, so on CI they skipped — pushing the job over the skip ceiling (69 > 56) that exists to catch exactly that. They now run against a hermetic fake install; Windows CI skips 50, Ubuntu 63, both under their ceilings.
• Two tests assumed Windows: one expected Set-Acl (a Windows-only cmdlet) to be denied on Linux, where the guard correctly fails closed to ask; one faked os.name = "nt" for the whole process, which crashed Python's path handling on Linux.
• A provenance-floor test could never reach the floor it names (a stale-store refusal fired first); it now does, and disabling the floor turns it red.

A fresh release review of this range found a leak in the new fake-install helper (it could leave fake paths behind for the rest of a test run when collected first) — fixed before this tag.

CI on the released commit: all three jobs green — Windows 2,919 passed / 50 skipped, Ubuntu 2,886 passed / 63 skipped, cold clone 2,878 passed, no personal data in any of the published commits.

Full detail: CHANGELOG.