test(#3090): normalize the whole reason line, not just the category token

The allow-test-rule gate keys on identity, and the identity it records is
everything after the colon on the annotation line — not the category token.
Ten annotations carried the canonical category plus a trailing justification
on the same line, so the recorded identity was a prose blob, and where the
prose wrapped it was a sentence fragment: `source-text-is-the-product — the
workflow .md content IS`.

Seven of those ten are ones this branch already rewrote. That pass renamed the
token and left the prose, which is the same error this wave exists to correct,
one level down: the label was fixed without checking what the machine reads.

Justifications move to the following comment line, which the scanner ignores
because it lacks the token. No annotation gains or loses an issue reference, so
no exemption changes compliance status; the allowlist goes 161 to 159 as two
files' duplicate identities collapse.

git-base-branch.test.cjs carried the token twice — once as the real annotation,
once echoed in docblock prose that the line scanner parsed as a second
exemption with a truncated identity. The echo is reworded to drop the literal
token.

intel.test.cjs:1360 was cut off mid-clause with an issue ref appended after the
break; its sentence is restored and the ref kept on the annotation line so it
stays compliant.

Every remaining non-canonical identity is an ESLint RuleTester fixture inside a
`code:` template literal, which the line scanner cannot tell apart from an
annotation. Those two stay grandfathered.

Refs #3057

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/intel.test.cjs

@@ -4,7 +4,8 @@
  * Covers: query, status, diff, validate, snapshot, patch-meta,
  * extract-exports, enabled/disabled gating, and CLI routing via gsd-tools.
  */
-// allow-test-rule: source-text-is-the-product — readFileSync assertions target API-SURFACE.md, which is the generated product of intelApiSurface; asserting on its text content is the only way to verify correct generation.
+// allow-test-rule: source-text-is-the-product
+// readFileSync assertions target API-SURFACE.md, which is the generated product of intelApiSurface; asserting on its text content is the only way to verify correct generation.
 
 'use strict';
 
@@ -1107,8 +1108,8 @@ describe('intelApiSurface', () => {
 });
 
 describe('#1000 regression: gsd-intel-updater emits canonical intel filenames', () => {
-  // allow-test-rule: source-text-is-the-product — agents/gsd-intel-updater.md IS the
-  // system prompt the intel-updater agent runs under; asserting its filename references
+  // allow-test-rule: source-text-is-the-product
+  // agents/gsd-intel-updater.md IS the system prompt the intel-updater agent runs under; asserting its filename references
   // verifies the deployed agent surface contract matches the INTEL_FILES the CLI reads.
   const agentPromptPath = path.join(__dirname, '..', 'agents', 'gsd-intel-updater.md');
   const agentPrompt = fs.readFileSync(agentPromptPath, 'utf8');
@@ -1357,9 +1358,9 @@ describe('bug #2351: intel updater kilo layout support', () => {
 {
   const { describe: __foldDescribe } = require('node:test');
   __foldDescribe("folded:bug-3290-intel-updater-layout-block (consolidation epic #1969 B7 #1976)", () => {
-// allow-test-rule: source-text-is-the-product — agents/gsd-intel-updater.md IS (see #3290)
-// the deployed agent instruction set. Asserting its text content tests the
-// deployed behaviour contract, not internal implementation.
+// allow-test-rule: source-text-is-the-product (see #3290)
+// agents/gsd-intel-updater.md IS the deployed agent instruction set. Asserting
+// its text content tests the deployed behaviour contract, not internal implementation.
 
 'use strict';