test: review-army + adversarial test hardening

- Tripwire scans execFileSync too (ceiling 8: two more grep-needle string
  exemptions); merge-introduced timeout-less spawnSync in
  question-preference-hook fixed — the tripwire caught a site that landed
  on main AFTER the sweep, on its first day.
- gstack-detach gains TWO watchdog kill regression tests: TERM-immune
  grandchild (the killpg-after-grace escalation) and the leader-dies
  variant (the pgid-at-spawn fix — the case the first test cannot see).
- eval-flake-rank gets its unit suite (final-attempt accounting, artifact
  exclusion, shard recursion, recency bound).
- Groupkill/startup-grace shim markers are per-run unique (pid-suffixed
  sleep durations): sibling Conductor worktrees run free suites with no
  machine lock, and fixed markers let one run pgrep/pkill the other's
  shims — a cross-run flake inside the anti-flake tests.
- flake-ledger test pins the project-scoped local default; stale empty
  section headers in touchfiles-data deleted (they invited entries under
  deliberately retired categories).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/flake-ledger.test.ts

@@ -52,8 +52,13 @@ describe('flake ledger', () => {
     fs.rmSync(dir, { recursive: true, force: true });
   });
 
-  test('env override wins over the tmpdir default', () => {
+  test('env override wins; local default is project-scoped, never machine-global', () => {
     expect(flakeLedgerPath({ GSTACK_FLAKE_LEDGER: '/x/y.jsonl' } as NodeJS.ProcessEnv)).toBe('/x/y.jsonl');
-    expect(flakeLedgerPath({} as NodeJS.ProcessEnv)).toContain('gstack-flake-ledger.jsonl');
+    // Without the env override, the default lives under the PROJECT dir
+    // (sibling worktrees of different repos must not interleave one series);
+    // tmpdir is only the last-resort fallback when slug detection fails.
+    const local = flakeLedgerPath({} as NodeJS.ProcessEnv);
+    expect(local).toMatch(/flake-ledger\.jsonl$/);
+    expect(local.includes(path.join('.gstack', 'projects')) || local.startsWith(os.tmpdir())).toBe(true);
   });
 });