Fixes#3762. pre:bash:gateguard-fact-force was missing from
FAIL_CLOSED_ON_TRUNCATION_HOOKS, so a Bash payload over the stdin cap
exited 0 while the Edit and PowerShell GateGuard ids blocked. Share one
GateGuard id set for the fail-closed list and the off-switch branch, and
add runner-level tests for all three ids plus each off switch.