docs(security): 修正 S4.13 owner response rollup 口徑

scripts/security/source-control-owner-response-guard.py

@@ -480,8 +480,37 @@ def assert_true(label: str, actual: Any) -> None:
     assert_equal(label, actual, True)
 
 
+def assert_contains(label: str, text: str, expected: str) -> None:
+    if expected not in text:
+        raise SystemExit(f"BLOCKED {label}: missing {expected!r}")
+
+
+def assert_not_contains(label: str, text: str, forbidden: str) -> None:
+    if forbidden in text:
+        raise SystemExit(f"BLOCKED {label}: forbidden {forbidden!r}")
+
+
+def validate_markdown_consistency(security_dir: Path) -> None:
+    rollup_doc = (security_dir / "SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md").read_text(
+        encoding="utf-8"
+    )
+    gap_audit_doc = (security_dir / "S4-9-OWNER-RESPONSE-GATE-CURRENT-GAP-AUDIT.md").read_text(
+        encoding="utf-8"
+    )
+
+    assert_contains("rollup_doc.total_template_formula", rollup_doc, "5 + 9 + 5 + 5 = 24")
+    assert_contains("rollup_doc.total_template_display", rollup_doc, "24 templates")
+    assert_not_contains("rollup_doc.stale_formula", rollup_doc, "5 + 7 + 5 + 5 = 22")
+    assert_not_contains("rollup_doc.stale_display", rollup_doc, "22 templates")
+    assert_contains("gap_audit_doc.latest_baseline_present", gap_audit_doc, "gitea/main=")
+    assert_not_contains("gap_audit_doc.stale_baseline_b615", gap_audit_doc, "b615bde5")
+    assert_not_contains("gap_audit_doc.stale_baseline_f1bad", gap_audit_doc, "f1bad81d")
+    assert_contains("gap_audit_doc.rollup_consistency", gap_audit_doc, "S4.13 rollup 文件一致性")
+
+
 def validate(root: Path) -> None:
     security_dir = root / "docs" / "security"
+    validate_markdown_consistency(security_dir)
     rollup = load_json(security_dir / "source-control-owner-response-validation-rollup.snapshot.json")
     rollup_summary = rollup["summary"]