fix(rectification): expand quality-gate pytest globs before argv

subprocess.run does not shell-expand tests/test_rectification_*.py, so a
string pin could stay green while the suite never ran. Expand glob targets
to real files and fail closed on zero matches.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/run_quality_gate.py

@@ -75,6 +75,31 @@ RUNTIME_TRUTH_PYTEST_TARGETS = [
     "tests/test_final_jhora_evidence_packet_acceptance.py",
 ]
 
+
+def _expand_pytest_targets(targets: list[str]) -> list[str]:
+    """Expand glob entries so pytest argv never depends on a shell.
+
+    `subprocess.run` is invoked without `shell=True`. A literal
+    `tests/test_rectification_*.py` is then a filename pytest may ignore,
+    so a pin that only checks the string is present can stay green while
+    the suite never runs.
+    """
+    expanded: list[str] = []
+    for target in targets:
+        if any(mark in target for mark in "*?["):
+            matches = sorted(
+                path.relative_to(ROOT).as_posix()
+                for path in ROOT.glob(target)
+                if path.is_file()
+            )
+            if not matches:
+                raise SystemExit(f"pytest glob {target!r} matched no files under {ROOT}")
+            expanded.extend(matches)
+            continue
+        expanded.append(target)
+    return expanded
+
+
 RELEASE_CRITICAL_UNTRACKED_PATHS = [
     "docs/research/desktop_packaging_spike_2026_06_23.md",
     "docs/research/ephemeris_abstraction_feasibility_2026_06_23.md",
@@ -515,7 +540,7 @@ def main() -> int:
         pytest_targets = RUNTIME_TRUTH_PYTEST_TARGETS
     else:
         pytest_targets = CORE_PYTEST_TARGETS
-    run([PYTHON, "-m", "pytest", *pytest_targets])
+    run([PYTHON, "-m", "pytest", *_expand_pytest_targets(pytest_targets)])
     if not profile["skip_frontend_runtime"]:
         run(["npm", "test"], optional=False, cwd=APP)
         run(["npm", "run", "lint"], optional=False, cwd=APP)