test: clean up the paid eval lane (B1-B4, B6, B7)

- B1: delete paid files that assert nothing or cannot pass meaningfully:
  skill-llm-eval-spec and skill-e2e-spec-execute (test.todo), gemini-e2e
  (+ gemini-session-runner; no gemini CLI in CI), ship-idempotency (red
  since v1.63), the two opus-4-7 *-sonnet overlay wrappers, conductor-prose
  (+ its source-evaluation replay), codex-e2e-plan-format; drop their keys,
  scripts and census rows.
- B2: skill-llm-eval grades browse/sections/command-list.md with one union
  judge that also carries the baseline score pin; regression-vs-baseline
  deleted (paid run: pass, c4/c4/a4).
- B3: memory-pipeline, ios-qa, ios-qa-swift-build and plan-tune-cathedral
  make no model calls; renamed out of the paid glob so they run on every
  PR. Swift builds need GSTACK_TEST_SWIFT=1; device stub deleted.
- B4: codex-e2e*, outside-voice, aside and ios-device cannot run in the CI
  image; excluded from the weekly lane with a tracked re-entry condition.
- B6: fold opus-47's negative routing controls into skill-routing-e2e
  journey-negatives (paid run: 3/3 unrouted) and delete the file.
- B7: delete the never-green brain-privacy-gate eval; a free
  gstack-skill-start test now proves consent precedes artifacts egress.

test/gstack-skill-start.test.ts

@@ -369,6 +369,40 @@ describe('gstack-skill-start behavior', () => {
     const out = runStart();
     expect(out).toMatch(/^ARTIFACTS_SYNC: off$/m);
   });
+
+  test('artifacts-sync consent is asked before any artifacts egress, and only in interactive sessions', () => {
+    const gh = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-ss-privacy-'));
+    const bin = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-ss-privacy-bin-'));
+    const remote = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-ss-privacy-remote-'));
+    const git = (args: string[], cwd: string) => execFileSync('git', args, { cwd, timeout: 30_000, stdio: 'pipe' });
+    try {
+      fs.writeFileSync(path.join(bin, 'gbrain'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+      git(['init', '-q', '--bare'], remote);
+      git(['init', '-q', '-b', 'main'], gh);
+      git(['remote', 'add', 'origin', remote], gh);
+      const pullStamp = path.join(gh, '.brain-last-pull');
+      const start = (config: string, env: Record<string, string> = {}) => {
+        fs.writeFileSync(path.join(gh, 'config.yaml'), `update_check: false\n${config}`);
+        return runStart([], { GSTACK_HOME: gh, PATH: `${bin}${path.delimiter}${process.env.PATH}`, ...env });
+      };
+      const gates = (out: string) => (out.match(/^GSTACK_INSTRUCTION_BEGIN: privacy-stop-gate/gm) ?? []).length;
+
+      const pending = start('');
+      expect(gates(pending)).toBe(1);
+      expect(pending).toContain('How much should sync?');
+      expect(pending).toMatch(/^ARTIFACTS_SYNC: off$/m);
+      expect(fs.existsSync(pullStamp)).toBe(false);
+
+      expect(gates(start('', { GSTACK_SESSION_KIND: 'spawned' }))).toBe(0);
+      expect(fs.existsSync(pullStamp)).toBe(false);
+
+      const consented = start('artifacts_sync_mode: full\nartifacts_sync_mode_prompted: true\n');
+      expect(gates(consented)).toBe(0);
+      expect(fs.existsSync(pullStamp)).toBe(true);
+    } finally {
+      for (const dir of [gh, bin, remote]) fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe('gstack-skill-end', () => {