startup_script_execution.yaml Test 7 is vacuous: string(@adr) returns the address path, not script source #899

Problem

tests/integration/test_cases/startup_script_execution.yaml Test 7 ("startupScript round-trips through script.newScriptObject (#621 regression guard)") is vacuous. Its first line:

local(src = string(@system.startup.startupScript));

does not fetch the script's source. string() is a coercion verb that takes a literal value; handed an ADDRESS it falls through to the address-form coercion and returns the address path as a string -- "system.startup.startupScript" (one line, 28 chars). The test then installs THAT one-line expression into a temp cell and asserts it compiles, which it always does. The #621 brace-balance regression the test claims to guard is not exercised at all.

Evidence

Reproduced while simulating Unit B (#855): installing the result of string(@system.startup.startupScript) via script.newScriptObject replaced the 258-line startup script with a 1-line script whose body evaluates to the script object itself. A protocol debug/getSource read-back showed 1 line; calling it returned the script value ("script: 1 line", type external) with no side effects.

Fix direction

Fetch real source before round-tripping. Options: the protocol debug/getSource op (comment/indentation-stripped -- fine for a compile check), or drive the round-trip from the .ut mirror text (usertalk_scripts/Frontier.root/system/startup/startupScript.ut), which is verified in sync by verify_virgin_root_sync. Whichever is chosen, the test should assert the recompiled script has the expected multi-line shape (e.g. line count > 200) so a future regression to the address-path behavior fails loudly.