fix(gates): audit beta.2 golden provenance

The immutable beta.2 candidate changed one version-bearing golden frame without the two baseline trailers. Its complete Linux Validate successor proved the exact baseline tree; record that one SHA as the only historical exception while preserving every other provenance check.

Issue: #426
Release: v1.71.0
Baseline-Reviewed: https://github.com/Matysh/houseplan-card/actions/runs/33760450815
User-Visible: no

test/commit-provenance.test.mjs

@@ -5,6 +5,7 @@ import {
   cleanedCommitMessage,
   resolveValidationRange,
   terminalTrailers,
+  validateHistoricalCommit,
   validateCommitMessage,
 } from '../scripts/validate-commit-provenance.mjs';
 
@@ -77,3 +78,12 @@ test('golden files require exact release-review provenance', () => {
     `${base}\nRelease: v1.2.3-beta.1\nBaseline-Reviewed: https://example.test/run`, changed,
   ), []);
 });
+
+test('the audited beta.2 baseline exception is exact and golden-only', () => {
+  const changed = ['demo/golden/baselines/example.png'];
+  const message = 'Update baseline\n\nIssue: #426\nUser-Visible: no';
+  const audited = 'd4dd027b0a27c3c290195cb0e504b1a44c4c2611';
+  assert.deepEqual(validateHistoricalCommit(audited, message, changed), []);
+  assert.equal(validateHistoricalCommit(`${audited.slice(0, -1)}2`, message, changed).length, 2);
+  assert.match(validateHistoricalCommit(audited, 'Update baseline', changed)[0], /Issue/);
+});