test(cli): public-door pins for install-local's refusal of an enabled job whose pull does not bind

Written ahead of the fix: run against unmodified main, the refusal pins
reproduce the reach (the door answers 200) and the controls hold.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016GiHYRmLSNWTfbX9gVQkpz

Author: claude