[Test] NoSyncWorkInHandlers ratchet: a false ledger reason, missing blocking names, and a scanner scope hole

[pathosDev]

Three follow-ups on tests/unit/ci/NoSyncWorkInHandlers.test.ts from the 2026-09-18 verification of #1540. None hides a defect today (a generic scan finds only reconcileSync ×5, getSync ×1, mkdtempSync ×3, DatabaseSync ×3 off-list, all legitimate); each is a way the ratchet could stop ratcheting.

1. A ledger reason is not true. The allow-list entry for GrpcClientActor's loadSync (:160-165) says "parses the .proto once in preStart; the actor is not receiving yet". The call sits in createServiceClient (src/io/broker/GrpcClientActor.ts:230, from :223), reached from connectImplementation (:277), which BrokerActor re-enters on every reconnect (BrokerActor.ts:849 → :913/:921, via _scheduleReconnect at :1086/:1149) while the actor is alive and buffering. Either move the parse to preStart (then the reason becomes true) or rewrite the reason to what it is: a reconnect-time parse the maintainers accept. GrpcServerActor.ts:205 really is in preStart.
2. The closed list omits blocking names of the same class: fs openSync/readSync/writeSync/fsyncSync/closeSync/lstatSync/realpathSync/cpSync/globSync, crypto.generateKeyPairSync, randomFillSync, Bun.sleepSync, Atomics.wait — a future openSync+writeSync+fsyncSync journal in a handler would be free. Add them with a fixture per name.
3. Scope holes: any directory named generated or node_modules at any depth under src/ or examples/ is skipped, and only .ts is read (.mts/.cts/.tsx invisible). None exist under src/ today; 19 frontend .tsx/.mjs/.js files under examples/ are unscanned.

Refs #1540.

Filed from the 2026-09-18 issue wave (#1540 verification (concerns 2, 3, 8)).