gapfill2: worker/sub90 coverage tests, G7 rollback branch, G5 caller-contract docs

H1 worker.py 92%->94% (277->210 miss): 35 real-assertion tests
covering goal-signal, tenant/env, followup, poll/wait,
process/watchdog and injected defensive branches; prod code 0 changes.
H2 sub-90 sweep: approval_timeout 100%, merge_gate_hard 100%,
worker_sweep 98% (only __main__ line 174 left); 14 tests.
H3 G7 rollback except:pass (server.py:6615-6616) covered by an
injected rollback-raising connection; original error still propagates,
status stays completed, retry succeeds; no semantics change.
H4 caller contract documented only (docstrings in _audit_scorecard
endpoint, check_baseline_stale, build_scorecard, baseline store):
current_main_head caller-supplied, any string as-is, no format checks,
missing/empty treated as not passed with no stale determination at the
endpoint, always 200, overall never rewritten; no new validation or
rejection, no response-structure change. 3 doc tests pin the wording.
H5 design notes (no decisions, no code changes) live in
verification/code-to10-gapfill2-design-notes.md, referenced by the
batch summary.
No bug found by the new tests; no existing assertion touched.

cloud/scorecard_baseline_store.py

@@ -13,7 +13,9 @@
 行字段：
 - rubric_version：评分口径版本（调用方传入的字符串，如 "v1"；
   本模块不规定口径内容、不替用户拍板阈值）。
-- baseline_head：冻结时调用方传入的 main 头（字符串，非空）。
+- baseline_head：冻结时调用方传入的 main 头（字符串，非空；
+  接受任意字符串原样存、不做格式校验，本模块不验证其真实性，
+  可信来源仍是调用方责任）。
 - frozen_at：冻结时间戳（秒，调用方不传时取当前时间）。
 - scorecard_snapshot：build_scorecard 输出的完整 dict，以 JSON
   文本存入，读回时还原为 dict。