Bump the quality kit pin so the board reports a measurement, not a label

[Antawari]

Contract

The mounted quality gate was pinned to a kit commit that predates the two kit rungs that make the aggregated board carry its own denominator. One line changes: the uses: ref in .github/workflows/quality.yml.

-...quality-gate.yml@86c9e0b5cd0a6c676eaefa05621aed5a6dfcc041
+...quality-gate.yml@18ffbaf23ad7327cae412678aa94c072ca5cf2a1

World

At the old pin the board printed twelve bare labels and not one denominator, so a vacuous gate and a working gate printed identically. The cleanest measurement of the hazard: setting [tool.complexipy] exclude = ["**/*.py"] made the gate report clean, print PASS complexipy, and rewrite the committed 21-file complexity floor to [].

That was verified on this tree, not assumed. Same worktree, same poisoned config, two kit versions:

kit	complexipy line	exit	committed floor after
old 86c9e0b5	PASS complexipy	0	emptied to 0 files / 0 functions
new 18ffbaf2	FAIL complexipy — measured 0 function(s) in 0 file(s) against a 29-function committed floor	2	survived, byte-identical

At the new pin the failure is typed GATE_COMPLEXIPY_MEASURED_NOTHING, and the gate no longer writes the floor it is grading against.

On this PR's own CI run the board now prints:

PASS  complexipy — measured 683 function(s) in 114 file(s) against a 29-function committed floor

The denominator was cross-checked: src/ holds 142 .py files, of which exactly 114 contain a def — the gauge measured every source file that has a function in it.

Failure

If the pin does not move, the gate keeps reporting a conclusion instead of an event, and the floor it defends stays writable by the tree it is supposed to be gauging.

Scope

Exactly one line, one file, one commit. No baseline was edited — complexipy-snapshot.json, exemptions.json, no-bon-ref-exemptions.json, mypy-baseline.txt and pyproject.toml are all unchanged (the first three proven byte-identical to base by blob SHA). No threshold relaxed, no check deleted, no test weakened.

What this change does NOT do — please read before reading the green

• Only complexipy gained a denominator. The other eleven lines are still bare labels. That is structural, not cosmetic: gate_runner._structured_verdict rebuilds each subprocess gate's verdict without its notices, so every cf-* gate's computed counts are parsed and discarded, while _emit_human prints notices under the docstring "a PASS must show what it measured". complexipy escapes this only because it is invoked in-process. Filed as a follow-up against the kit, not fixed here.
• The anchor-grading half of this bump is unrodded. The new pin activates exemption-anchor grading over all 52 entries with four new red paths. Every entry is live today, so none of those paths was observed firing. Its PASS is real but unwitnessed.
• Three line-anchored exemption entries (git/scratch.py:55 S105, onboard/server.py:446 and :447 S101) were verified to still carry their noqa on the anchored line. They are reported as a notice while they still cover live code, but they are genuinely rot-graded: a digit anchor routes to _line_anchor_verdict, which raises EXEMPTION_SUPPRESSION_GONE the moment the anchor stops covering a live suppression. Any insertion above those lines turns the gate red. Their premise is sound — scratch.py:55 is a module-level constant with no enclosing symbol, and server.py:446/447 are two S101 asserts in one method that a symbol anchor would match ambiguously — but they are a standing hazard.
• The in-band mount self-verification logs a SKIPPED warning because no admin-scoped CI token is provisioned. Known open finding, untouched here.

Note on reproducibility

github.job_workflow_sha came through empty on this run, so the kit checkout fell back to the kit default branch and the pin-honouring guard reported "already rides the declared pin" — true, but only because this pin currently is kit main's tip. The fetch-and-re-anchor path was therefore not exercised, and until kit main advances past this SHA the behaviour is indistinguishable from floating on kit main.