t398: correct two false statements in FleetConfigValidateAllTest

Measured at review: reverting validateAll() to a hardcoded list of
today's six calls leaves the suite green (1491 tests, 0 failures). The
class javadoc claimed that mutation fails a test. It does not — claim 1
pins the generic helper on an unrelated class, claim 2 pins today's six,
and a hardcoded list satisfies both.

The interaction was the real hazard. The denominator assertion IS a
tripwire (declaring a seventh validator fails it), but its failure
message said the sweep reaches new validators 'by construction' and told
the author to just update the expected set. If the sweep were ever
replaced by a name list, the one assertion that fires would hand back a
false all-clear at the moment it fired.

Javadoc now states the measurement, and names the denominator test as
the actual guarantee. The assertion message now says to confirm
validateAll() still delegates to invokeAllValidators(this) BEFORE
updating the expected set.

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -53,9 +53,17 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
  * FleetdStartupValidationTest} (which prove the real startup call site still calls {@code
  * validateAll()}) and the {@code ConfigRefTest} reload tests (which prove the same for {@link
- * ConfigRef#reload()}), removing {@code cfg.validateAll();} from either real call site, or
- * reverting {@link FleetConfig#validateAll()} to a hardcoded list of method calls, now fails a
- * test in this module.
+ * ConfigRef#reload()}), removing {@code cfg.validateAll();} from either real call site now fails
+ * a test in this module.
+ *
+ * <p><b>What is NOT pinned, measured rather than assumed.</b> Reverting {@link
+ * FleetConfig#validateAll()} to a hardcoded list of today's six method calls leaves the whole
+ * suite green (measured at review: 1491 tests, 0 failures). Nothing ties {@code validateAll()} to
+ * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
+ * 2 proves {@code validateAll()} reaches today's six, and a hardcoded list satisfies both. So the
+ * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
+ * #fleetConfigDeclaresExactlyTheseSixValidatorsToday()}: it fails the moment a seventh validator
+ * is declared, which forces whoever adds it to look at this file.
  */
 class FleetConfigValidateAllTest {
 
@@ -226,9 +234,11 @@ class FleetConfigValidateAllTest {
         assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
                 "validateModels")), names,
-                "FleetConfig's public validate*() methods changed — this is not a failure by "
-                        + "itself (validateAll() sweeps whatever is here, by construction), it is "
-                        + "this test's own denominator; update the expected set to match");
+                "FleetConfig's public validate*() methods changed. Do TWO things, in this "
+                        + "order. First confirm validateAll() still delegates to "
+                        + "invokeAllValidators(this) — a hardcoded list there passes every other "
+                        + "test in this class, so this assertion is the only place that will ever "
+                        + "make you check. Only then update the expected set to match.");
     }
 
     /** A minimal, otherwise-valid file — same shape FleetConfigTest and ConfigRefTest use. */