test: update stale drift guards (login-page A mark, 25 exempt ports)

Both predate this session's changes and were masked by the release
gate's cargo-test-weekly compile timeout:
- login_page_sources_its_art_from_the_gate still asserted the retired
  wordmark (logo-archipelago.svg); the login page ships the sidebar A
  mark (favico-black-v2.svg) since the 2026-08-05 rework.
- unauthenticated_ports_are_all_accounted_for lagged at 17; the
  v1.7.123 port-policy round grew the rationale-carrying exempt set
  to 25 (reviewed and enumerated in the test comment).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/appgate/mod.rs

@@ -932,7 +932,10 @@ mod tests {
             );
         }
         // Every referenced asset must be one the gate will actually serve.
-        assert!(read_ui_asset("logo-archipelago.svg").is_some() || cfg!(not(debug_assertions)));
+        // The logo is the sidebar A mark (favico-black-v2.svg) since the
+        // 2026-08-05 login-page rework — the old wordmark is off the
+        // allowlist on purpose.
+        assert!(read_ui_asset("favico-black-v2.svg").is_some() || cfg!(not(debug_assertions)));
     }
 
     /// The allowlist is the whole security boundary for asset serving: the

core/container/src/manifest.rs

@@ -1717,9 +1717,17 @@ app:
             }
         }
         exempt.sort();
+        // 25 as of the v1.7.123 port-policy round: bitcoin p2p (8333 ×2),
+        // core-lightning 9736/9835, electrumx 50001, fedimint 8173/8174,
+        // fedimint-gateway 8176/9737, gitea ssh 2222, lightning-stack
+        // 8091/9738/10010, lnd 9735/10009/18080, netbird 3478/8086/8087,
+        // pine TLS 10381 + the three voice ports (10200/10300/10400 — the
+        // disclosed known gap), router SSDP/mDNS 1900/5353. Every one is a
+        // deliberate, rationale-carrying exemption; the release-gate test
+        // stage timed out that cycle, so the count here lagged at 17.
         assert_eq!(
             exempt.len(),
-            17,
+            25,
             "unauthenticated port set changed — review before updating this count: {exempt:?}"
         );
     }