Portico check-org-scoped.yml: add KNUCK-A032 failure-path self-test

---
feature_id: FEAT-studio-dependency-map-policy
labels:
  - governance
  - portico
  - guard-inventory
---

## Context

Filed from the OPER-119 dispatch run, which ported Studio's KNUCK-A032
guard-inventory gate to Portico (`Operant-Health/portico` PR #1698). That PR
lands `docs/knuckles-guard-inventory.md` with eight Portico guard rows; four
carry a `KNUCK-A032 gap` marker because the guard has no failure-path
self-test. This ticket closes one of those four.

Rule 3 of the ported inventory doc: `selftest: no` is allowed only with a
`KNUCK-A032 gap` marker in the Ledger column, and the gap must have a live
Ledger ticket to close it. As authored, the four markers point at KNUCK-A045,
which is CANCELED (superseded by OPER-117 and its children), so the rows as
shipped cite a dead ticket. This ticket is the live replacement for the
`check-org-scoped.yml` row.

Guard under test: `.github/workflows/check-org-scoped.yml` on `Operant-Health/portico` —
Prisma org-scope allowlist + DiagnosticLens taxonomy version (POR-291 AC-9, POR-682).

What an honest self-test has to prove (from the inventory's "Open gaps"
table): A model without `organizationId` and off the allowlist still fails the check; a lens-taxonomy bump without consumer review still fails.

Reference implementations already on Portico: `no-scaffolding-stub.yml` (step
`Test the tripwire (proves it still fires on POR-477 fake evidence)`, which
runs before the main scan) and `check-required-not-skipped.yml` (job `Test the
detector (proves it fires on a skipped required context)`). Studio's
`check-view-drift.yml` is the original pattern. Once PR #1698 merges, the
inventory row is the thing to edit; before then the row lives on branch
`agent/oper-119-guard-inventory-selftest`.

Filed as an OPER ticket rather than POR because this whole port program is
tracked on the `operant` team (OPER-117 parent, OPER-118/119/120/121 children)
and because Portico's `products/portico/feature-map.md` declares no CI or
governance feature to hang a POR feature_id on.

## Acceptance Criteria

- PR on `Operant-Health/portico` adds a failure-path self-test to
  `.github/workflows/check-org-scoped.yml` that fails on a fixture model that lacks `organizationId` and is not on the allowlist, and on a lens-taxonomy bump with no consumer review
- The self-test runs BEFORE the guard's own scan in the same workflow, so a
  broken guard fails CI instead of reporting green
- The self-test fails when the guard's detector is deliberately broken —
  demonstrate it on a scratch commit and link the failing run in the PR
- `docs/knuckles-guard-inventory.md` row for `check-org-scoped.yml` flips to `selftest: yes`
  with the exact self-test job or step name in the "Self-test job / step"
  column, and the Ledger column cites this ticket instead of KNUCK-A045
- The corresponding row in the doc's "Open gaps (selftest: no)" table is
  removed
- `pnpm tsx scripts/check-guard-inventory.ts` passes on the PR