Merge origin/main (v1.64.1.0) into garrytan/time-attack-fork-review

The code-smell wave refactored the tunnel start into the staged
startTunnel helper; the merge adopts that structure and threads this
branch's truthful consent strings through its consent parameter (the
receipt now names the isPairAgentEnabled gate at both call sites). The
eng-review PTY warmup takes both improvements: main's resolveClaudeBinary
fallback and this branch's resolveEvalModel kind. Resolver imports
union; carve budgets take the larger of both waves' measured values
(parity suite green on the merged tree); conflicted generated SKILL.md
files regenerated from resolved sources. VERSION stays 1.65.0.0 over
main's 1.64.1.0; CHANGELOG stacks 1.65.0.0 > 1.64.1.0 > 1.64.0.0.

bin/gstack-codex-session-import

@@ -64,8 +64,11 @@ case "$MODE" in
       echo "NO_SESSIONS: $CODEX_SESSIONS_ROOT does not exist"
       exit 0
     fi
+    # xargs -r: GNU xargs runs `ls -t` once even on EMPTY input (listing the
+    # cwd and producing a bogus LATEST); BSD xargs skips it. -r pins the
+    # BSD behavior on both.
     LATEST=$(find "$CODEX_SESSIONS_ROOT" -type f -name "rollout-*.jsonl" -print 2>/dev/null \
-      | xargs ls -t 2>/dev/null | head -1 || true)
+      | xargs -r ls -t 2>/dev/null | head -1 || true)
     if [ -z "$LATEST" ]; then
       echo "NO_SESSIONS: no rollout-*.jsonl files under $CODEX_SESSIONS_ROOT"
       exit 0

bin/gstack-session-update

@@ -146,6 +146,11 @@ fi
   else
     log_entry "UP_TO_DATE head=$OLD_HEAD"
   fi
-) &
+# The detached subshell must own its stdio: it inherits the session hook's
+# pipes, and once the hook exits and the caller closes them, any child that
+# writes (git pull's autostash notice, setup output) dies of SIGPIPE —
+# observed as PULL_FAILED exit=141 with an empty stderr capture. All
+# observability goes through LOG_FILE.
+) >/dev/null 2>&1 &
 
 exit 0