chore(auth): service-token guard review follow-ups

What

Six non-blocking review follow-ups from !1709 (merged), taken after it merged. Comments, docs, and one test; no production behaviour change.

• Pin the fallback guard's cancellation skip with a local cancelling validator, so deleting the arm fails a test — thread
• Note the dot-segment shape in shortCircuit's comment: ServeMux answers a 307 to the cleaned path instead of dispatching to the guard — thread
• Make the wrong-second-segment case comment describe its own fixture — thread
• List the GitLab API guard in cmd_smoke's doc comment, matching SKILL.md, and reattach the comment to the function — thread
• Record that an unresolvable auth.gitlab_api reference fails the boot — thread
• Record the table's departures from S08's 404 fall-through, and scope the spec pointer to the six rows it covers — thread

Stacked on !1713 (merged); retargets to main once that merges.

Related to #356 (closed)