test(security): hold the new boot double to the engine-double contracts

The `find` double added for the #18535 anchor pins refuses a WHERE combinator
it does not implement instead of comparing it as a field name, applies the
caller's bound by presence after the filter, and its grown seam counts are
ratcheted into the engine-double ledger.

Claude-Session: https://claude.ai/code/session_01Gqi43smmqjJ5sUrhfoPeKu
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/security-plugin.test.ts

@@ -4298,9 +4298,23 @@ describe('audience-anchor bindings read the stack\'s declared capabilities (#185
       registerMiddleware: () => {},
       find: async (object: string, opts?: any) => {
         const where = opts?.where ?? {};
-        return (tables[object] ?? []).filter((r: any) =>
-          Object.entries(where).every(([k, v]) => r[k] === v),
+        const matched = (tables[object] ?? []).filter((r: any) =>
+          // The matcher REFUSES what it does not implement rather than
+          // answering as if it had: a `$or` key compared as a field name
+          // matches no row and reports that as "no rows"
+          // (`check:where-matcher` — refusal is the conforming cheap answer for
+          // a double that only ever sees scalar equality).
+          Object.entries(where).every(([k, v]) => {
+            if (k.startsWith('$')) {
+              throw new Error(`test double: unsupported WHERE combinator '${k}' — implement it or narrow the fixture`);
+            }
+            return r[k] === v;
+          }),
         );
+        // The caller's bound, applied BY PRESENCE and after the filter — the
+        // plugin reads `limit: 5` here to tell an organization-less row from
+        // this organization's own (`check:objectql-double-limit`).
+        return typeof opts?.limit === 'number' ? matched.slice(0, opts.limit) : matched;
       },
       findOne: async (object: string, query?: EngineFindOneQueryInput) => {
         assertEngineFindOnePredicate(object, query);

scripts/engine-double-contract.pinned.json

@@ -2999,12 +2999,12 @@
     {
       "file": "packages/plugins/plugin-security/src/security-plugin.test.ts",
       "verb": "findOne",
-      "pinned": 5
+      "pinned": 6
     },
     {
       "file": "packages/plugins/plugin-security/src/security-plugin.test.ts",
       "verb": "update",
-      "pinned": 1
+      "pinned": 2
     },
     {
       "file": "packages/plugins/plugin-security/src/seed-write-refusal.test.ts",