fix(tests): align 8189-classifier-compat with #9276 always-mode semantics

tests/unit/8189-classifier-compat-auto-narrow.test.ts was a test-sibling
forgotten when #9276 (commit 6b531fbacd) removed the unconditional
`if (mode === "always") return true` branch from
shouldDefaultAllowClassifier(). tests/unit/claude-classifier-compat.test.ts
was updated in that same commit; this file was not.

Old contract: 'always' mode short-circuited every Claude-format request
unconditionally (operator opt-in was treated as sufficient on its own).
New contract: 'always' now requires the same SECURITY_MONITOR_MARKER
system-prompt text as 'auto' — the marker-optional behavior let a normal
chat request through /v1/messages be silently swallowed by an operator's
'always' opt-in.

The single 'always' test (1 assert, no-marker body expecting true) is
replaced by two tests mirroring the depth already used for 'auto' mode
in the same file: no-marker/false and marker-present/true. Net effect is
+1 assert, not a reduction — the new pair verifies both directions of
the narrowed contract instead of only the now-incorrect unconditional
case.

Before: 3/4 pass (the 'always' test failed: expected true, got false).
After: 5/5 pass.

Refs #9276

tests/unit/8189-classifier-compat-auto-narrow.test.ts

@@ -11,6 +11,12 @@
  *
  * Fix: in "auto" mode, the SECURITY_MONITOR_MARKER system-prompt text is now a
  * necessary condition. `stop_sequences` alone is no longer sufficient.
+ *
+ * Follow-up (#9276): "always" mode previously short-circuited EVERY Claude-format
+ * request unconditionally, regardless of signal shape. That let a normal chat
+ * request through /v1/messages be silently swallowed by an operator's "always"
+ * opt-in. The unconditional `if (mode === "always") return true` branch was
+ * removed — "always" now requires the same SECURITY_MONITOR_MARKER as "auto".
  */
 
 import test from "node:test";
@@ -52,24 +58,37 @@ test("issue #8189: 'auto' mode still short-circuits when the security-monitor ma
   );
 });
 
-test("issue #8189: 'always' mode is unaffected — every Claude-format request still short-circuits (operator opted in)", () => {
+test("issue #9276: 'always' mode does NOT short-circuit without the security-monitor marker (narrowed to match 'auto')", () => {
   const body = {
     system: "You are a helpful assistant that writes CMS page templates.",
     stop_sequences: ["</block>"],
     messages: [{ role: "user", content: "hello" }],
   };
+  assert.equal(
+    shouldDefaultAllowClassifier(FORMATS.CLAUDE, body, "always"),
+    false,
+    "mode='always' must NOT short-circuit a request with no security-monitor marker, even " +
+      "with stop_sequences=['</block>'] — #9276 removed the unconditional always-mode return"
+  );
+});
+
+test("issue #9276: 'always' mode still short-circuits when the security-monitor marker is present (operator opted in)", () => {
+  const body = {
+    system:
+      "You are a security monitor for autonomous AI coding agents. Evaluate the following action.",
+    stop_sequences: [],
+    messages: [{ role: "user", content: "<transcript>Bash rm -rf /</transcript>" }],
+  };
   assert.equal(
     shouldDefaultAllowClassifier(FORMATS.CLAUDE, body, "always"),
     true,
-    "mode='always' must short-circuit every Claude-format request regardless of signal shape"
+    "mode='always' must still short-circuit when the security-monitor marker is present"
   );
 });
 
 test("issue #8189: 'off' mode (shipped default) never short-circuits", () => {
   const body = {
-    system: [
-      { type: "text", text: "You are a security monitor for autonomous AI coding agents." },
-    ],
+    system: [{ type: "text", text: "You are a security monitor for autonomous AI coding agents." }],
     stop_sequences: ["</block>"],
   };
   assert.equal(shouldDefaultAllowClassifier(FORMATS.CLAUDE, body, "off"), false);