ci(untrusted-input): the catalog-table check passes on any **109** in a 27,000-line doc #5881

Defect

scripts/ci/test_catalog_table_matches_the_gate.py (Untrusted Input Gate, step "The published catalog table still matches the tree") checks P17's re-take with

f"| **{records}** |" in doc or f"**{records}**" in doc

where records is grep -c 'CATALOG:' specs/numeric/formats_catalog.t27 (109 today) and doc is the whole of docs/theory/IGLA-FORMAL-RESULTS.md -- 27,000+ lines.

The reviewer of #5801 confirmed on 2026-10-04 that a single unrelated occurrence satisfies it on its own: T397, around line 17104, says **109** records and **436** fields. Delete P17's re-take entirely and the check stays green. It is green today, but it can pass by coincidence and it cannot detect drift.

#5801 (merge 17f09865a, closing #5799) fixed the same flaw in scripts/ci/test_retaken_propositions_still_match.py: the corpus figure became one generated block <!-- corpus-count anchor=<40-hex> -->N<!-- /corpus-count -->, written by --write and checked against the tree at its anchor.

Fix

Reuse that pattern for the catalog figure, with the shared parts in one helper both scripts import:

• P17's figure becomes one block, <!-- catalog-count anchor=<40-hex> -->N<!-- /catalog-count -->, written by test_catalog_table_matches_the_gate.py --write.
• CI checks the block against CATALOG: lines in specs/numeric/formats_catalog.t27 in the tree at the anchor, against its RE-TAKEN AT heading, and against the re-take's mandatory-field row.
• Nothing outside the marker is read.

Negative controls (to be in the PR)

wrong block -> red; wrong block + the right number planted elsewhere -> red (the old check is green here); correct block -> green; marker removed -> red.