test(strict,cascade): pin documented enforcement limits and audit coverage gaps

[dimitri-yatsenko]

Final piece of the post-2.3 audit remediation (companions: #1480 update1 gate, #1484 cascade fix, datajoint/datajoint-docs#195 docs batch). These tests lock the documented best-effort limits of strict_provenance and the untested cascade part-integrity paths — so a regression in either direction (a documented bypass silently closing, or a blocking path silently opening) becomes visible.

test_strict_provenance_limits.py — the read/write-gate surface, empirically pinned

Idiom (inside strict make())	Pinned behavior
len(Undeclared & key), bool(Undeclared & c)	bypass (documented limit)
{...} in (Undeclared & r) (query-expr form)	bypass (documented)
{...} in Undeclared (class form)	RAISES — metaclass __iter__ routes through the gated cursor (real asymmetry, now locked)
(Ancestor & Undeclared).fetch() restriction-by-table	bypass (documented)
(Undeclared * Ancestor).fetch() join	RAISES "undeclared" — the one gated read path, previously untested
len(dj.U(...).aggr(Undeclared, ...))	bypass; the same aggregation's .fetch() RAISES
delete_quick() on another/undeclared table	bypass (documented: deletes ungated)
self.insert(<QueryExpression>)	target gate holds; per-row key consistency skipped (documented INSERT…SELECT exception)
self.upstream[SelfPart] vs self.PartName read	upstream raises; direct read allowed
context cleanup after a raising make(); nested push/pop token restore	verified

test_cascade_integrity.py

• Enforce post-check + rollback: cascade reaching a Part without its Master raises "before its master" and rolls back completely (previously only the Part.delete pre-guard had a test).
• Empty-materialization sentinel: cascade mode with zero matching part rows previews the master at 0 and deletes cleanly.
• U3 upward arm: a Part with a secondary -> master FK — proj(*attr_map.keys()) correctly restricts only the right master; a bare proj() would have restricted both (assertion distinguishes the exact fix(#1429): cascade through FK chain for part_integrity="cascade" #1468 code path).

Also

• Corrects the provenance.py module docstring (audit item B6): context is pushed/popped inside _populate_one in whichever process/thread runs the make() — the old "inherits at fork time / across threads" rationale was inaccurate (behavior unchanged).

New files only — no conflicts with the #1480/#1484 branches. All 12 new tests green locally on MySQL + PostgreSQL; existing strict suite unaffected (8/8).

Note: the schema in the read-limits test gives Undeclared an FK from the declared ancestor so the semijoin probe has shared attribute lineage (semantic matching requires it) while Undeclared stays outside the allowed set — a descendant, not an ancestor.