fix: what wave 1's gate found: B-43 speaks CHOICE, a Linux-only socket test is Linux-only

GitHub's check on f043db35: bookspec's `rules_md_carries_every_id`
refuses "DECISION" in docs/spec/rules.md (bookspec's word is CHOICE,
P13 step 3); P4's B-43 wrote "DECISION D-47" twice. The portable
macOS job: `a_socket_with_no_other_end_names_no_process_and_isnt_us`
uses `SOCK_CLOEXEC` and Linux's answer for a peerless socket; it is
gated to Linux, which is what it tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-mcp/src/local.rs

@@ -2640,7 +2640,9 @@ mod tests {
 
     /// A socket with no other end: the system answers for it (Linux: no
     /// process, no user), and that answer names neither this process nor
-    /// this account; the client's check refuses it.
+    /// this account; the client's check refuses it. Linux only: the
+    /// answer and `SOCK_CLOEXEC` are Linux's (the portable job found it).
+    #[cfg(target_os = "linux")]
     #[test]
     fn a_socket_with_no_other_end_names_no_process_and_isnt_us() {
         use std::os::fd::FromRawFd;