fix: adversarial review fixes (Claude + Codex cross-model passes)

Both adversarial passes ran against the wave; every FIXABLE finding landed
with a regression test:

- probeTimeoutMs clamps to >=1ms: a fractional override floored to 0, and
  execFileSync treats timeout:0 as NO timeout — the probe that exists to
  bound hangs could hang forever (found by both models independently).
- /ship silent hook install now requires the hooks dir to live inside
  .git: with core.hooksPath (husky's COMMITTED .husky/), the chaining
  installer would have renamed the team's committed pre-push and written a
  machine-local wrapper into the working tree (found by both models).
- gstack-config gbrain-refresh accepts the "timeout" status — the last
  consumer still gating on literal "ok" (Codex); gstack-gbrain-detect's
  config-derived fields honor GBRAIN_HOME so the detection JSON can't
  report status ok alongside config_exists false (Codex).
- prepush: a remote sha absent locally (shallow clone / stale fetch) falls
  back to the merge-base/empty-tree range — scans MORE, never blocks a
  legitimate push into training users toward --no-verify.
- dashboards: curl's own 000 no longer doubles to "HTTP 000000"; the
  community dashboard flags stale snapshots like the security one; array
  sections parse via jq (the sed/grep loops truncated at the first ']');
  the no-jq marker grep tolerates whitespace.
- telemetry: multi-line redactor output nulls the field instead of
  corrupting the JSONL record; setup's hint fires only when the config key
  is genuinely unset (an explicit false is a recorded decline); the /ship
  prompt marker honors GSTACK_HOME.

Kept as designed (cross-model tension noted): Bearer stays MEDIUM in the
prepush gate — a HIGH Bearer would block every docs example; the entropy
validator can't eliminate that FP class, and MEDIUM warns visibly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-community-dashboard

@@ -38,7 +38,11 @@ trap 'rm -f "$TMPBODY"' EXIT
 HTTP_CODE="$(curl -s --max-time 15 -w '%{http_code}' -o "$TMPBODY" \
   "${SUPABASE_URL}/functions/v1/community-pulse" \
   -H "apikey: ${ANON_KEY}" \
-  2>/dev/null || echo "000")"
+  2>/dev/null || true)"
+# curl prints its own 000 before a non-zero exit — a `|| echo` here would
+# double it to "000000" in user-facing output. Normalize to the last 3 chars.
+HTTP_CODE="$(printf '%s' "$HTTP_CODE" | tr -d '[:space:]' | tail -c 3)"
+[ -n "$HTTP_CODE" ] || HTTP_CODE="000"
 DATA="$(cat "$TMPBODY" 2>/dev/null || echo "")"
 
 echo "gstack community dashboard"
@@ -57,15 +61,21 @@ WEEKLY="$(echo "$DATA" | grep -o '"weekly_active":[0-9]*' | grep -o '[0-9]*' ||
 CHANGE="$(echo "$DATA" | grep -o '"change_pct":[0-9-]*' | grep -o '[0-9-]*' || echo "0")"
 
 echo "Weekly active installs: ${WEEKLY}"
-# Marker check: jq when available (whitespace/reserialization-proof); grep
-# fallback only matches the compact form the edge function emits today.
+# Marker check: jq when available (whitespace/reserialization-proof); the
+# grep fallback tolerates optional whitespace around the colon.
+_STALE="false"
 if command -v jq >/dev/null 2>&1; then
   _MARKER="$(printf '%s' "$DATA" | jq -r '.status // empty' 2>/dev/null)"
+  _STALE="$(printf '%s' "$DATA" | jq -r '.stale // false' 2>/dev/null)"
 else
-  _MARKER="$(printf '%s' "$DATA" | grep -q '"status":"ok"' && echo ok || true)"
+  _MARKER="$(printf '%s' "$DATA" | grep -Eq '"status"[[:space:]]*:[[:space:]]*"ok"' && echo ok || true)"
 fi
 if [ "$_MARKER" != "ok" ]; then
   echo "  (unverified — legacy backend response; deploy the latest community-pulse for verified figures)"
+elif [ "$_STALE" = "true" ]; then
+  # Backend serves its last good snapshot when recompute fails — real but
+  # frozen figures must not read as current (matches security-dashboard).
+  echo "  (stale snapshot — backend recompute failing; figures may be out of date)"
 fi
 if [ "$CHANGE" -gt 0 ] 2>/dev/null; then
   echo "  Change: +${CHANGE}%"