fix(sandbox-doctor): keep both heredoc bodies under the 512B pipe-deadlock window

The cycle-2 additions pushed the python-patch and bashrc heredocs into the
512-65536B window test/heredoc-pipe-deadlock.test.ts guards (sh scripts get
no BASH_COMPAT escape hatch). Same content, tighter prose; the drift warning
now reuses the patch pattern variable instead of a second literal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/sandbox-doctor.sh

@@ -73,12 +73,8 @@ new = 'exit 0\nelse\n\tstatus=$?\nfi'
 if old in src:
     open('/conductor/bin/git', 'w').write(src.replace(old, new))
     print('sandbox-doctor: patched /conductor/bin/git exit-code laundering')
-elif 'else\n\tstatus=$?\nfi' not in src:
-    # Loud on format drift: the outer guard matched but the byte-exact patch
-    # pattern did not — silence here would read as "fixed" while phantom git
-    # successes persist.
-    print('sandbox-doctor: WARNING /conductor/bin/git matched the laundering guard '
-          'but not the patch pattern — exit-code laundering NOT fixed; patch it by hand')
+elif new not in src:
+    print('sandbox-doctor: WARNING git shim drifted from the patch pattern; laundering NOT fixed, patch by hand')
 EOF
 fi
 
@@ -87,11 +83,9 @@ if ! grep -q 'GSTACK sandbox test env' "$HOME/.bashrc" 2>/dev/null; then
   cat >> "$HOME/.bashrc" <<'EOF'
 
 # GSTACK sandbox test env (written by scripts/sandbox-doctor.sh)
-# NOTE: GSTACK_FREE_RETRY_FLAKY=1 deliberately overrides the runner's
-# default-OFF contract ("dev boxes should see flakes, not absorb them") —
-# this sandbox's seccomp supervisor injects spurious one-off failures under
-# load, which the serial retry absorbs while still failing on reproducible
-# breakage. Delete this block from ~/.bashrc to restore the default.
+# RETRY_FLAKY=1 overrides the runner's default-OFF contract on purpose:
+# the seccomp supervisor injects spurious one-off failures under load.
+# Delete this block to restore the default.
 export TMPDIR="$HOME/tmp"
 export GSTACK_FREE_JOBS=2
 export GSTACK_FREE_RETRY_FLAKY=1