gate: a branch taken per operating system needs a test that injects one

[EdbertChan]

A guard's screen-lock and idle probes returned early on anything but macOS.
The suite was green on a Mac and red on Linux CI with "unexpectedly None",
because the branch under test only ever ran on the author's machine.

The coverage gate now asks any detector that reads sys.platform for a test
that passes a platform in. Backtested against the tests as first written:
fires. Against the fixed ones: silent.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01KU2pPKob4MJ1NqjsfTNyYJ

Depends-On: #508

---

Note

Low Risk
Changes only the static coverage checker and its tests; no runtime hook or detector behavior is modified in this diff.

Overview
Extends the hook test coverage gate so detectors that branch on the host OS cannot pass with only positive/negative tests that run on whatever machine executes CI.

check_hook now flags hooks whose detect.py references sys.platform or platform.system unless at least one test file contains platform injection patterns (e.g. platform='linux'). The error message tells authors to pass platform in instead of relying on the host, so non-macOS paths are exercised on Linux CI.

Unit tests in TestPlatformBranchRule cover fail-without-injection, pass-with-injection, and no-op for inline detectors without OS branches.

^{Reviewed by Cursor Bugbot for commit 1ec58f5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[EdbertChan]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	hook: a script handed to the user is a claim that it runs	#506
2	audit(token_audit): count "bogus" and "it didn't run" as the same class	#507
3	hook: refuse a quoted command string passed through a login shell	#508
4	gate: a branch taken per operating system needs a test that injects one	#509	👈
5	audit(token_audit): one submission carrying two slash commands is one message	#510
6	audit: use the transcript's own markers for what the human actually sent	#511

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5ede4904-9e80-419f-8b01-70487cd603c6)