untrusted-input: corpus count is a substring anywhere in a 27k-line doc -- red on every spec PR, green by coincidence #5799

What is wrong

untrusted-input (.github/workflows/untrusted-input-gate.yml, step "Every re-taken proposition is still anchored") runs scripts/ci/test_retaken_propositions_still_match.py, which requires str(walked) in doc: today's count of .t27 files under specs/ (outside scratch) must appear anywhere in the 27k-line docs/theory/IGLA-FORMAL-RESULTS.md.

That is wrong in both directions:

• Red for the wrong reason. Every PR that adds a spec moves the count, so the check fails merely because the PR adds a spec. The doc's re-take says 1146 (anchored at 4f65684d); master walks 1166 today (188884e89) and the check is red on master itself:
  FAILED the corpus size is stated somewhere in the re-takes: 1166 appears nowhere
• Green by coincidence. At 1156 master passed only because T444 enumerates "1156 alphabets" -- an unrelated number elsewhere in the doc.

Found while reviewing #5785 (split-reel v7). crm-story-reel v22 will hit it too.

Why "the PR that adds specs re-takes" does not hold

#5597 (docs/now/2026-10-02-retake-the-corpus-figures-on-master.md) set that policy. Two days later master was 20 specs past the figure. On 2026-10-03 master took 15 new specs, five spec-adding merges inside 90 seconds; two branches that both regenerate N -> N+1 make the identical edit and merge cleanly into a wrong number.

Fix

Mark the figure: <!-- corpus-count anchor=<40-hex sha> -->N<!-- /corpus-count -->, generated by test_retaken_propositions_still_match.py --write, and check the stated relation: N equals the spec count of the tree at the anchor (fetched by SHA in CI). A spec PR does not change the anchor's tree; no number outside the marker is read.