'assent doctor' prints 'arming precondition MET' from an author-spoofable env self-assertion #159

Severity: Low-medium (hygiene, not a live bypass). Review finding D10, doctor half; the vision half was fixed in #157, and this half was deferred. Re-verified at 1c4e71e.

readPipelineDescription (cmd/assent/doctor.go:164-171) trusts ASSENT_PIPELINE_CONFIG_PROTECTED. An author-editable .gitlab-ci.yml can export that variable, and the comment itself says the reader "MUST replace this reader before any approve/merge write is gated on ArmEligible". The run path now gates on the forge probe, so the reader's only remaining role is assent doctor without GITLAB_TOKEN. That run still prints:

assent doctor: arming precondition MET (env self-assertion — INSECURE, unverified)

(cmd/assent/doctor_forge.go:88). A "MET" verdict built on an author-spoofable self-assertion is exactly what ADR-0015 §4 forbids. The banner reduces the risk but does not remove it: anything that greps doctor output for MET is misled.

Fix: retire the env-only MET. Either require the token for any MET verdict, or print UNVERIFIED / NOT MET without it. Then delete readPipelineDescription, or narrow it to diagnostics only.