fix: red-team review fixes (9 findings, 2 critical)

Red team reviewed what four specialists missed — cross-cutting and
self-contradiction class:

CRITICAL: the release-body banner tripwire failed OPEN on the exact leak it
guards (grep -c prints 0 AND exits 1 on no-match, so a fallback echo
double-emitted "0" twice and the -gt comparison fell into the clean branch) —
counts now default via parameter expansion, and a functional drift test
executes the rendered tripwire block against a 0->1 banner delta to prove the
ABORT branch fires. CRITICAL: evidence fingerprints were captured AFTER the
child exited, so a working-tree edit made DURING a long suite was certified as
tested content — wtree is now captured before spawn and re-checked after;
mid-run drift omits the fingerprint (grades STALE) with a warning.

Also: the review-grading rule dropped its dirty-gates (they nullified the
keystone dirty-record->commit->CURRENT property that evidence checks already
honor — wtree equality alone proves identical content); careful's HIGH
force-push tier falls back to probing origin/main|master when the origin/HEAD
symbolic ref is absent (Conductor worktrees — the tier was silently inert in
the primary deploy environment); quoted tokens (rm -rf "/", push "main") no
longer dodge the deny; freeze fails CLOSED when its own helper file is missing
(bash makes a missing source target fatal non-interactively, so an existence
pre-check guards it); spec dedupe distinguishes pipeline failure from zero
matches instead of silently skipping dedupe on gh/jq breakage; land 3.5b sets
the cross-session --expect-cmd mismatch expectation; hook analytics JSON
fields are encoder-built per this wave's own rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-evidence

@@ -178,6 +178,10 @@ async function cmdRun(argv: string[]): Promise<number> {
   }
   const log = paths ? openLog(paths.logsDir, label, cmdSha) : undefined;
 
+  // Fingerprint the content BEFORE the child runs: a working-tree edit made
+  // DURING a long suite must not be certified as "the tested content".
+  const wtreeBefore = currentWtree();
+
   const started = Date.now();
   let exitCode: number;
   let proc: ReturnType<typeof Bun.spawn> | undefined;
@@ -187,7 +191,7 @@ async function cmdRun(argv: string[]): Promise<number> {
     // Spawn failure (ENOENT on argv-direct form): record exit 127, propagate 127.
     exitCode = 127;
     warn(`spawn failed: ${e?.message ?? e}`);
-    record(paths, log?.path, label, commandString, cmdSha, exitCode, started);
+    record(paths, log?.path, label, commandString, cmdSha, exitCode, started, wtreeBefore);
     return exitCode;
   }
 
@@ -239,7 +243,7 @@ async function cmdRun(argv: string[]): Promise<number> {
     }
   }
 
-  record(paths, log?.path, label, commandString, cmdSha, exitCode, started);
+  record(paths, log?.path, label, commandString, cmdSha, exitCode, started, wtreeBefore);
   return exitCode;
 }
 
@@ -251,6 +255,7 @@ function record(
   cmdSha: string,
   exitCode: number,
   startedMs: number,
+  wtreeBefore: string | undefined,
 ): void {
   if (!paths) return;
   try {
@@ -269,7 +274,15 @@ function record(
       rec.commit = commit;
       rec.tree = git(["rev-parse", "HEAD^{tree}"]);
       rec.dirty = (git(["status", "--porcelain", "-uno"]) ?? "") !== "";
-      rec.wtree = currentWtree();
+      // TOCTOU guard: the fingerprint is only trustworthy when the content was
+      // IDENTICAL before and after the run. A mid-run edit omits wtree, so
+      // check grades STALE instead of certifying content the suite never ran.
+      const wtreeAfter = currentWtree();
+      if (wtreeBefore && wtreeAfter && wtreeBefore === wtreeAfter) {
+        rec.wtree = wtreeAfter;
+      } else if (wtreeBefore || wtreeAfter) {
+        warn("working-tree content changed during the run — evidence recorded without a content fingerprint (will grade STALE)");
+      }
     }
     if (logPath) rec.log_path = logPath;
     appendJsonl(paths.file, rec, { mode: 0o600 });