Negative control. A generic company login — a password field but no brand SSO signature. sso-clone must stay silent (false-positive guard).