Adds tests/test_legacy_secgate_other_paths.py — non-e2e unit guards for the
OTHER legacy security_level gate paths uncovered by GOAL #346's audit
(GOAL #347 / [#347-sub-2]):
P1 middle+ batch-install entry gate (_install_custom_node)
P2 unknown-pip 'block' unconditional deny (Q1)
P3 nodepack/snapshot high+/middle (comfyui_switch_version, restore_snapshot)
P4 model non-.safetensors high+ gate (_install_model)
Two layers, both exercise REAL code: decision-table tests drive the REAL
is_allowed_security_level (full truth table per level) + response-shape tests
invoke the REAL async handlers asserting observable 403/404/200, each deny
paired with an allow/flip. Reuses the _install_flags_testutil stub approach
(+ minimal server/nodes/folder_paths stubs and an inert get_data) so no real
server / E2E_ROOT is needed. Test-only; no production code changed.
Non-vacuity verified by mutation: weakening 'block' fails 17, weakening
middle+ fails 4.
