Correct composed validation scope and retain the initial fixture skip

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7

build/forgejo/README.md

@@ -165,3 +165,8 @@ path. That is an implementation requirement under RAPPS16-T09/NK48-T43, not a
 claim that the callback implements those routes or a native deployment grant.
 Ongoing resource/action/current-group decisions, protected operation/inverse and
 all release writers/journal custody remain acceptance work.
+
+Final composed source validation passes 116 test/subtest results without skips.
+The initial 114-pass run skipped its private file-replacement check because a
+reused fixture was exhausted; the runner now creates fresh private/read-only
+aliases. That initial skip is retained and is not PostgreSQL acceptance.

workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md

@@ -316,8 +316,10 @@ Mandatory owner application-tenant/current-token admission, ID-token purpose,
 exact signed RS256 at_hash, current status before/after the PDP, and signed
 identity/assurance/authentication-time/tenant-provenance joins refuse substitution
 and stale authority. The latest focused callback/identity suite passes 91 results
-without skips; the selected four composed packages passed 114 results with one
-optional PostgreSQL test skipped before the additional owner-tenant regression.
+without skips; the final selected four composed packages pass 116 results without
+skips. The earlier 114-pass run skipped the private file-replacement check because
+its reused fixture directory was exhausted; a fresh private/read-only fixture
+restores that check. The original skip is retained, not PostgreSQL evidence.
 The actual HTTP PKCE/discovery/UserInfo/status/revocation and Forgejo provider /
 callback pass five fresh consumer processes: two current grants accepted, mixed
 pair/revoked original/suspended human refused. The original verifier and issuer