test_release_test_composition ordering assertion is stale after the frontend-build/verify split

## Summary

On `worktree/ai-eval-containers`, a full `just test` fails in `contracts.release` at
`tests/capsem-release/test_release_test_composition.py::test_static_module_orders_fast_checks_before_docker_preflight`.

```
assert fast.index("check-web-surface.sh frontend") < fast.index("cargo clippy")
E assert 4266 < 3673
```

## Why it looks like a stale contract, not a plan bug

The test asserts a `check-web-surface.sh frontend*` surface is rendered before `cargo clippy`
in the `test-fast` plan. But `[websurfaces]` in `config/gate.toml` deliberately split the old
monolithic `frontend` target into `frontend-build` (produces `web/app/dist`, which clippy needs
via `tauri::generate_context!`) and `frontend-verify` (type-check + vitest, produces nothing),
and set `blocks_clippy = "frontend-build"`. So clippy correctly waits only on `frontend-build`,
and `frontend-verify` is free to render after clippy.

`test_static_module_orders_fast_checks_before_docker_preflight` still searches for the substring
`"check-web-surface.sh frontend"`, which matches both `frontend-build` and `frontend-verify`;
`.index()` takes the first occurrence in the rendered plan text, and in the current plan that is
after clippy. The assertion predates the frontend-build/verify split and no longer expresses the
real invariant.

## What the invariant should be

Clippy must follow `frontend-build` (the producer), not any `frontend*` surface. The test should
assert `fast.index("check-web-surface.sh frontend-build") < fast.index("cargo clippy")`, or assert
on the dependency edge rather than rendered text order.

## Scope note

Found while getting the branch to pass a full local `just test`. Flagging rather than editing the
contract test blind, since it is gate-composition/ordering and wants the gate owner's eye. Not
introduced by this branch's networking work.

Start with tests/capsem-release/test_release_test_composition.py::test_static_module_orders_fast_checks_before_docker_preflight and inspect [websurfaces] in config/gate.toml. Run the targeted test, then just test; done means the contract checks frontend-build before cargo clippy and the full test suite passes.

Written by the indexing model from the issue text.