chore(gates): declare the list-user-invitations endpoint conformant in PLUGIN_ROUTE_MODULES

The module added for the declared-verification fix writes a Hono response, so
the route-envelope walk discovers it, and a discovered file absent from the
table is an ERROR rather than a default.

Measured with the gate's own `scanHonoRouteSource`: one body, all six asserted
counters zero. The single write is `return ctx.json(pendingInvitations)`, whose
argument is an identifier -- the deliberate relayed-body blindness -- and the
three refusals are `throw APIError.*`, which this surface does not count. So
`{}` is the honest declaration: nothing this file builds departs from the
envelope. No ruled state applies and nothing was hoisted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Author: claude

scripts/check-route-envelope.mjs

@@ -758,6 +758,30 @@ const PLUGIN_ROUTE_MODULES = {
   // our own shells, and the migration was one key.
   'packages/adapters/hono/src/index.ts': {},
 
+  // [#16569] FIRST AUDIT — swept in by the walk, verdict conformant. The module
+  // rebuilds better-auth's `/organization/list-user-invitations` endpoint in place
+  // so the DECLARED `requireEmailVerificationOnInvitation` is honoured, and it
+  // BUILDS exactly ONE body: `return ctx.json(pendingInvitations)`. The argument
+  // is an IDENTIFIER, so the counters read it as relayed — the same deliberate
+  // blindness `inbound-rate-limit.ts` sits behind on surface 4 — and what it names
+  // is better-auth's own rows: the vendor's exported
+  // `getOrgAdapter(ctx.context, options).listUserInvitations(email)` produces them
+  // and the vendor's `status === 'pending'` post-filter narrows them. No shape is
+  // minted here, so there is no literal for a counter to read and none to hoist.
+  // The three refusals are `throw APIError.*` — the vendor's flat
+  // `{ message, code }`, RAISED rather than written — which this surface does not
+  // count either; the single countable write is therefore the file's whole visible
+  // departure, not a sample of it.
+  //
+  // Worth keeping distinct from its twin: `admin-impersonate-endpoint.ts` below
+  // takes the SAME in-place-rebuild door in this same package and needed the
+  // `vendorWire` ruling, because reimplementing that handler turned a relay into a
+  // BUILT literal (`ctx.json({ session, user })`) and made a vendor-owned shape
+  // visible to the counters. Here the rebuild never re-shapes the body, so nothing
+  // became visible and no ruled state applies. Read this `{}` for what it is:
+  // nothing this file BUILDS departs from the envelope.
+  'packages/plugins/plugin-auth/src/list-user-invitations-verification.ts': {},
+
   // ── Ratchet: real, tracked, NOT blessed ─────────────────────────────────
   //
   // Measured by #9267 when this surface was added, not chosen. Each entry names