fix(test): unblock the pre-push gate on two stale contract assertions

Both failures were red on origin/dev too, so the pre-push hook was
refusing everyone's push, not just this session's. Neither is a real
defect - each is a contract test that outlived the code it pins.

The parity sweep gained /api/github/star from the sidebar star feature
with no CLI counterpart. Rather than invent `ocx github star` to satisfy
a table, the endpoint is listed as GUI-only with the reason: a one-click
social action has nothing to offer a headless surface. The sweep stays
exhaustive instead of silently skipping the endpoint.

The account-pool assertion pinned `}, [enabled, load]);` while the effect
now reads apiBase and correctly depends on it (cafdc4986) - omitting it
would be the stale-closure bug the assertion exists to prevent. Updated
to the real dep list; the load-bearing part, that pauseCount is absent,
is unchanged and now stated in the comment.

bun test tests/provider-workspace-auth.test.ts tests/cli-headless-parity.test.ts:
22 pass 0 fail.

Author: lidge-jun

tests/cli-headless-parity.test.ts

@@ -57,6 +57,12 @@ describe("headless GUI parity CLI", () => {
       ["/api/claude-desktop", "ocx claude desktop"],
       ["/api/claude/", "ocx observe"],
       ["/api/codex-auth", "ocx account"],
+      // GUI-only affordance: starring the repo from the sidebar. There is deliberately
+      // no CLI mirror — the headless surface has nothing to gain from a one-click
+      // social action, and inventing `ocx github star` would be a command nobody asked
+      // for. Listed here so the parity sweep stays exhaustive rather than silently
+      // skipping the endpoint.
+      ["/api/github/star", "(none — GUI-only)"],
       ["/api/oauth", "ocx account"],
       ["/api/providers/keys", "ocx account"],
       ["/api/providers", "ocx provider"],

tests/provider-workspace-auth.test.ts

@@ -209,7 +209,11 @@ describe("workspace account integration seam", () => {
     expect(hook).toContain("pauseTokensRef");
     expect(hook).toContain("if (!enabled || pauseCount > 0) return;");
     // The initial load must not be re-triggered by pause transitions.
-    expect(hook).toContain("}, [enabled, load]);");
+    // `apiBase` joined the dep list when the initial-load guard became per-base
+    // (cafdc4986): the effect reads it, so omitting it would be the stale-closure bug
+    // this assertion is meant to protect against. What still matters is the absence of
+    // `pauseCount` — that is what would re-fire the initial load on every pause.
+    expect(hook).toContain("}, [apiBase, enabled, load]);");
     // Reauth OAuth payload lives in the extracted OAuth hook (modal only wires props).
     expect(oauthHook).toContain("reauth: true");
     expect(oauthHook).toContain("startedReauthRef");