fix(runtime): locate the remaining secret-gate refusals

[ohdearquant]

A content secret gate refusal now names the record and field it fired on at the remaining write paths. The locating wrappers and the first 48 call sites landed earlier; this converts the rest.

What changed. 57 gate calls across the knowledge pack's domain and section ingest, the brain pack handlers, the code pack's source ingest, the direct code-ingest path, the stream batch writer, the archive importer and the note writer now report a location. Four batch loops gain an index, so a refusal from a bulk call reads section[3].content or entity[1].name rather than naming a field with no record.

One detail worth stating because it is a choice rather than an accident: the section index is the position in the discovered list, which is what the caller submitted, not the position among the sections that survived the minimum-length filter. A caller looking for section[3] should count the sections they sent.

Two documentation drifts, fixed with it. The wrappers called their first parameter scope and described it as the verb for a single-record write, while every call site in the tree passes a record noun: entity, note, task, proposal, message. The code was right, so the parameter and the prose now both say record.

The two outbound delivery paths both reported message.delivery, and no payload has a field by that name. One scans delivered_at and transport_message_id, the other failed_at and last_error. They now report message.delivered and message.failed, which match the verb that carries them.

Deliberately not converted. Two sites in the version-control sync path already name the record and the field in the error context they build, so converting them would say it twice. Test and acceptance files that call the gate directly are checking the detector, not writing records, and are left alone.

Scope. This adds identity to a refusal. No detector, no classification and no fail-closed behaviour changes: the wrappers pass every non-refusal error through untouched, which the existing tests for the wrapper mechanism already assert.