fix: pre-landing review fixes

Red Team pass 1 (all below the floor): an 11-digit span with a leading 1
after a run word is a US or Chinese national number, not a run id, and
reports again; ubi-runner pack removes its temporary repository when it
fails and replays branch.* with remote.* so a branch's upstream resolves
on the VM; the conservative-refusal example in docs/review-policy.md
reads in the refusing direction; the touchfiles header names why ETHOS.md
sits only under the two prompts that quote it. Step 6's selection found
captain/templates/merge-ask.md as the one unknown dependency of this PR
and registered captain/templates/** in FREE_ONLY_PR_FILES (#3499).

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

scripts/test-pr-profile.ts

@@ -235,6 +235,7 @@ export const FREE_ONLY_PR_FILES = [
   'scripts/paid-test-durations.json',
   'scripts/ubicloud/**',
   'capy/skill/**', // The vendored Capy skill (Drive bootstrapper): run by Capy agents, read by no paid case; test/capy-skill-wrapper.test.ts covers it.
+  'captain/templates/**', // The /captain crew templates (CREW.md, merge-ask.md, slot-call.md, …): copied into a Captain's drive by people and Captains, read by no paid case; free test/captain-skill.test.ts covers them (#3499).
   'tsconfig.test.json', // Read only by `tsc -p tsconfig.test.json` (typecheck:test); Bun's runtime reads tsconfig.json.
   '.gitignore', // Changes which untracked files git reports, never tracked content a case reads.
   '.gstack/generated.json', // gstack's own regen registry: gstack-regen/gstack-pregate read it from origin/<base> of the repo they run in; paid cases run in fixture repos.

scripts/ubicloud/ubi-runner.sh

@@ -597,7 +597,9 @@ cmd_down() {
 # origin/<base> still resolves, and the index is copied (git writes it
 # atomically through a rename). A linked worktree's .git is a one-line
 # pointer into the main repository, useless on the VM; the same snapshot
-# replaces it, on the worktree's own branch and index.
+# replaces it, on the worktree's own branch and index. Not carried: submodule
+# repositories (.git/modules) and a partial clone's promisor (the fetch pulls
+# every missing blob first); gstack has neither.
 cmd_pack() {
   local src tmp gitdir branch head entry
   src=$(cd "${1:-.}" && pwd)
@@ -605,6 +607,7 @@ cmd_pack() {
     head=$(git -C "$src" rev-parse --verify -q HEAD) || die "pack: $src has no commits; the VM needs a HEAD to fingerprint"
     branch=$(git -C "$src" symbolic-ref -q --short HEAD || true)
     tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
     git init -q --bare "$tmp/.git"
     git -C "$tmp/.git" fetch -q --no-tags --update-shallow "$src" '+refs/*:refs/*' \
       || die "pack: could not snapshot the refs of $src"
@@ -617,7 +620,7 @@ cmd_pack() {
     gitdir=$(cd "$src" && cd "$(git rev-parse --git-common-dir)" && pwd)
     while IFS= read -r -d '' entry; do
       git -C "$tmp/.git" config --add "${entry%%$'\n'*}" "${entry#*$'\n'}"
-    done < <(git -C "$gitdir" config --local --null --get-regexp '^remote\.' 2>/dev/null || true)
+    done < <(git -C "$gitdir" config --local --null --get-regexp '^(remote|branch)\.' 2>/dev/null || true)
     # The checkout's index rides along so the VM's status matches, except a
     # split index, whose shared half lives only in the original git dir.
     [ "$(git -C "$src" config --bool core.splitIndex 2>/dev/null)" = true ] \
@@ -630,7 +633,7 @@ cmd_pack() {
           done \
         | tar --null -T - -c -C "$tmp" .git -zf -
     )
-    rm -rf "$tmp"
+    rm -rf "$tmp"; trap - EXIT
   else
     tar -C "$src" -czf - .
   fi