test: consent-gate E2E suite + functional fs-capability probes

Five hermetic gate-tier E2E cases (tpa-present / absent-linux / broken /
absent-darwin / apple-ban) drive the real contract section through
claude -p with PATH shims for aside and uname; the absent cases filter
any REAL aside binary out of the child PATH and assert absence with
Bun.which before spawning, so dev machines cannot leak into detection.
Registered per-case in E2E_TOUCHFILES/E2E_TIERS with template-level
deps (ship/SKILL.md.tmpl, gen-skill-docs.ts) and added to the evals.yml
matrix with tier: gate. eval:bg:periodic's detach timeout rises to
36000s for the grown periodic shard census (floor-enforced by
test/eval-detach-timeout-floor.test.ts); CLAUDE.md doc updated to match.

test/helpers/fs-caps.ts adds canRevokeWrites/canRevokeReads functional
probes; 13 chmod-based tests swap their uid-0-only guards for the
probes so suites skip honestly on CAP_DAC_OVERRIDE containers (this
sandbox: uid 1000 with full caps) instead of asserting revocations the
kernel ignores. path-validation's symlink test targets /etc/passwd
(exists everywhere; /etc/crontab is absent on Amazon Linux).

test/timeline-stop-hook.test.ts

@@ -10,6 +10,7 @@
  * with outcome "unknown" + source "stop-hook" for every un-closed "started".
  */
 import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import { canRevokeWrites } from './helpers/fs-caps';
 import { spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';
@@ -437,7 +438,7 @@ describe('timeline-stop-hook wiring', () => {
     // Root can write through 0o555 directories, so the failure injection
     // (read-only dir) does not bind there; the invariant is still covered by
     // the atomic tmp+rename pinned in the re-point test above.
-    if (typeof process.getuid === 'function' && process.getuid() === 0) return;
+    if (!canRevokeWrites()) return; // chmod is advisory here (win32, root, DAC-override containers)
 
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-ensure-fail-'));
     try {