fix: adversarial review fixes (Claude + Codex cross-model passes)

Both adversarial passes ran against the wave; every FIXABLE finding landed
with a regression test:

- probeTimeoutMs clamps to >=1ms: a fractional override floored to 0, and
  execFileSync treats timeout:0 as NO timeout — the probe that exists to
  bound hangs could hang forever (found by both models independently).
- /ship silent hook install now requires the hooks dir to live inside
  .git: with core.hooksPath (husky's COMMITTED .husky/), the chaining
  installer would have renamed the team's committed pre-push and written a
  machine-local wrapper into the working tree (found by both models).
- gstack-config gbrain-refresh accepts the "timeout" status — the last
  consumer still gating on literal "ok" (Codex); gstack-gbrain-detect's
  config-derived fields honor GBRAIN_HOME so the detection JSON can't
  report status ok alongside config_exists false (Codex).
- prepush: a remote sha absent locally (shallow clone / stale fetch) falls
  back to the merge-base/empty-tree range — scans MORE, never blocks a
  legitimate push into training users toward --no-verify.
- dashboards: curl's own 000 no longer doubles to "HTTP 000000"; the
  community dashboard flags stale snapshots like the security one; array
  sections parse via jq (the sed/grep loops truncated at the first ']');
  the no-jq marker grep tolerates whitespace.
- telemetry: multi-line redactor output nulls the field instead of
  corrupting the JSONL record; setup's hint fires only when the config key
  is genuinely unset (an explicit false is a recorded decline); the /ship
  prompt marker honors GSTACK_HOME.

Kept as designed (cross-model tension noted): Bearer stays MEDIUM in the
prepush gate — a HIGH Bearer would block every docs example; the entropy
validator can't eliminate that FP class, and MEDIUM warns visibly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/security-dashboard-fallback.test.ts

@@ -101,7 +101,7 @@ function run(
     // needs — everything except jq.
     const toolBin = join(tmp, "tool-bin");
     mkdirSync(toolBin, { recursive: true });
-    for (const tool of ["mktemp", "cat", "grep", "head", "sed", "awk", "rm", "sh", "bash"]) {
+    for (const tool of ["mktemp", "cat", "grep", "head", "sed", "awk", "rm", "sh", "bash", "tr", "tail"]) {
       const real = Bun.which(tool);
       if (real) symlinkSync(real, join(toolBin, tool));
     }
@@ -254,4 +254,19 @@ describe("gstack-community-dashboard — never reports fake zeros (#1947)", () =
     expect(r.stdout).toContain("Weekly active installs: 42");
     expect(r.stdout).not.toContain("unverified");
   });
+
+  it("stale snapshot flagged in human mode (matches security-dashboard)", () => {
+    const staleBody = JSON.stringify({ ...JSON.parse(GOOD_BODY_MARKER), stale: true });
+    const r = run(COMM_BIN, { mode: "ok", body: staleBody });
+    expect(r.stdout).toContain("Weekly active installs: 42");
+    expect(r.stdout).toContain("stale snapshot");
+  });
+
+  it("network failure reports HTTP 000, never a doubled 000000", () => {
+    // Adversarial review finding 6: curl prints its own 000 before a
+    // non-zero exit; a `|| echo` doubled it in user-facing output.
+    const r = run(COMM_BIN, { mode: "netfail" });
+    expect(r.stdout).toContain("(HTTP 000)");
+    expect(r.stdout).not.toContain("000000");
+  });
 });