WR-02: capture docker run exit directly (not the piped head exit) so a chatty booting image can't SIGPIPE to 141 and false-PASS; require the FATAL guard marker in output as a positive assertion. WR-05: strip comment lines and use anchored fixed-string (grep -qF) matching so a commented-out rule can't satisfy the hygiene check and patterns aren't treated as regexes.