Name the flake job, and pin the probe guard's boundary

[siliconwitch]

The job rename you asked for, plus the two findings the adversarial review of #23 confirmed. It found four, of which three were the same documentation defect filed by three lenses.

The rename

ci.yml and flake.yml both called their job build, so #23 showed two checks with the same name and no way to tell which had failed. The three jobs are release, build and flake now.

The probe guard

The review found that nothing held the widened condition on account delete's probe. Reverting != http.StatusOK to the == http.StatusUnauthorized it replaced left the whole package green, because every test answered the probe with 200 or 401 and both take the same branch either way.

I verified that myself before acting on it, and it is right. #23's commit message said every new guard had been checked against the mutation that breaks it. That was true only of the coarse mutation which deletes the guard outright; the boundary survived. The claim was stronger than the check behind it.

The two standalone probe tests become one table over 401, 503 and 426, so a refusal of any kind stops the delete, suppresses the question, and relays the server's own sentence. The 503 case is reachable against the real server: superstack-server/internal/api/auth.go:52 answers 503 when the login lookup fails, and /fleets is not on the exemption list.

Evidence

• gofmt -l . clean, go mod tidy leaves the module files unchanged, go vet ./... clean, go test -count=1 ./... all packages pass.
• Three mutations checked against the new table: narrowing the condition back to 401, removing it, and pointing the probe back at the health check the server does not authenticate. All caught, including the one that previously survived.
• actionlint passes on the renamed workflow.

Two of my own mutation runs during this work reported results from a setup that had silently failed, once because a copy omitted an untracked file and once because an anchor was not unique. Both were discarded and re-run rather than reported.

No version change. Paired with a documentation change in superstack-server.