fix: red-team review fixes (9 findings, 2 critical)

Red team reviewed what four specialists missed — cross-cutting and
self-contradiction class:

CRITICAL: the release-body banner tripwire failed OPEN on the exact leak it
guards (grep -c prints 0 AND exits 1 on no-match, so a fallback echo
double-emitted "0" twice and the -gt comparison fell into the clean branch) —
counts now default via parameter expansion, and a functional drift test
executes the rendered tripwire block against a 0->1 banner delta to prove the
ABORT branch fires. CRITICAL: evidence fingerprints were captured AFTER the
child exited, so a working-tree edit made DURING a long suite was certified as
tested content — wtree is now captured before spawn and re-checked after;
mid-run drift omits the fingerprint (grades STALE) with a warning.

Also: the review-grading rule dropped its dirty-gates (they nullified the
keystone dirty-record->commit->CURRENT property that evidence checks already
honor — wtree equality alone proves identical content); careful's HIGH
force-push tier falls back to probing origin/main|master when the origin/HEAD
symbolic ref is absent (Conductor worktrees — the tier was silently inert in
the primary deploy environment); quoted tokens (rm -rf "/", push "main") no
longer dodge the deny; freeze fails CLOSED when its own helper file is missing
(bash makes a missing source target fatal non-interactively, so an existence
pre-check guards it); spec dedupe distinguishes pipeline failure from zero
matches instead of silently skipping dedupe on gh/jq breakage; land 3.5b sets
the cross-session --expect-cmd mismatch expectation; hook analytics JSON
fields are encoder-built per this wave's own rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

freeze/bin/check-freeze.sh

@@ -20,7 +20,16 @@ INPUT=$(cat)
 # escaped quotes and failed OPEN; the shared file kills that drift class.
 _HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=careful/bin/hook-extract.sh
-. "$_HOOK_DIR/../../careful/bin/hook-extract.sh"
+# Freeze is deny-tier: if its own helpers are missing/broken (partial install,
+# mid-upgrade state), the boundary must fail CLOSED — inline JSON, since the
+# encoder we would normally use lives in the file that just failed to load.
+# NOTE: bash treats `.` on a MISSING file as fatal in non-interactive shells
+# (an if-guard cannot catch it) — the existence check must come first.
+_HOOK_HELPER="$_HOOK_DIR/../../careful/bin/hook-extract.sh"
+if [ ! -f "$_HOOK_HELPER" ] || ! . "$_HOOK_HELPER" 2>/dev/null; then
+  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Hook helpers unavailable (broken install?) - blocked, fail closed. Reinstall gstack or run /unfreeze."}}\n'
+  exit 0
+fi
 
 # Locate the freeze directory state file
 STATE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.gstack}"