test(stalker): make the simple-portal skip test prove portal mode

Fourth test found passing through the wrong exit, from auditing all ten in the
block rather than waiting to trip over another one.

`skips the handshake for a simple portal` used a foreign-host command, so the
classification step returned before the warm-up was reached. `ensureToken` was
indeed not called — but because the host was foreign, not because the portal
was simple, and the assertion could not tell those apart. The command is now
portal-owned, so the skip can only come from the mode, and the test also pins
the returned URL and that no request was made.

Mutation-checked properly this time: removing the simple-portal early return
from `ensureStalkerSession` now fails this test. Under the old command it
would not have.

Also records the pattern where the next person will meet it. The decision
chain has several exits — no flag evidence, unresolvable command, `series`
set, foreign host, unusable session — and more than one can satisfy the same
assertion, so a foreign-host command silently stands in for "simple portal" or
"handshake failed". Mutation testing does not catch that class: it proves a
test is coupled to its target, not that it reached the mechanism it names.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/architecture/stalker-portal.md

@@ -488,6 +488,18 @@ Revisit both only with a portal that demonstrably fails without them.
 
 ### Regression coverage
 
+**Writing tests against this section:** the decision chain has several exits —
+no flag evidence, unresolvable command shape, `series` set, foreign host,
+session unusable — and more than one of them can satisfy the same assertion.
+Four tests in the PR that introduced this were found passing through an exit
+other than the one they named (a foreign-host command reaches neither the
+handshake nor `create_link`, so it silently stands in for "simple portal" or
+"handshake failed"). Mutation testing does not catch it: it proves a test is
+coupled to its target, not that it reached the mechanism in its name. Check the
+mock setup against the execution path, and assert the step you mean was
+actually taken — `expect(ensureToken).toHaveBeenCalled()` rather than only the
+returned URL.
+
 - `stalker-link-semantics.utils.spec.ts` — the decision table above.
 - `stalker-vod.utils.spec.ts` — both flags survive
   `buildStalkerSelectedVodItem` / `normalizeStalkerVodDetailsItem` /