fix: red-team review fixes (9 findings, 2 critical)

Red team reviewed what four specialists missed — cross-cutting and
self-contradiction class:

CRITICAL: the release-body banner tripwire failed OPEN on the exact leak it
guards (grep -c prints 0 AND exits 1 on no-match, so a fallback echo
double-emitted "0" twice and the -gt comparison fell into the clean branch) —
counts now default via parameter expansion, and a functional drift test
executes the rendered tripwire block against a 0->1 banner delta to prove the
ABORT branch fires. CRITICAL: evidence fingerprints were captured AFTER the
child exited, so a working-tree edit made DURING a long suite was certified as
tested content — wtree is now captured before spawn and re-checked after;
mid-run drift omits the fingerprint (grades STALE) with a warning.

Also: the review-grading rule dropped its dirty-gates (they nullified the
keystone dirty-record->commit->CURRENT property that evidence checks already
honor — wtree equality alone proves identical content); careful's HIGH
force-push tier falls back to probing origin/main|master when the origin/HEAD
symbolic ref is absent (Conductor worktrees — the tier was silently inert in
the primary deploy environment); quoted tokens (rm -rf "/", push "main") no
longer dodge the deny; freeze fails CLOSED when its own helper file is missing
(bash makes a missing source target fatal non-interactively, so an existence
pre-check guards it); spec dedupe distinguishes pipeline failure from zero
matches instead of silently skipping dedupe on gh/jq breakage; land 3.5b sets
the cross-session --expect-cmd mismatch expectation; hook analytics JSON
fields are encoder-built per this wave's own rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/binding-template-drift.test.ts

@@ -57,11 +57,35 @@ describe('content-binding template drift', () => {
     expect(rendered('land-and-deploy/SKILL.md')).toMatch(rowList);
   });
 
-  test('release-body write side carries the banner tripwire', () => {
+  test('release-body write side carries the banner tripwire (and it actually fires)', () => {
     const body = rendered('document-release/sections/release-body.md');
     expect(body).toContain('grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md');
     expect(body).toContain('grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md');
+    // The fail-open shape: grep -c prints 0 AND exits 1 on no-match, so an
+    // `|| echo 0` double-emits and breaks the -gt into the clean branch.
+    expect(body).not.toContain('|| echo 0');
     expect(body).toContain('banner tripwire clean');
+
+    // Functional: execute the template's tripwire block against a 0-banner
+    // original and a 1-banner outgoing body — the ABORT branch must fire.
+    const block = body.match(/_ORIG_BANNERS=\$\(grep[\s\S]*?fi\n/);
+    expect(block).not.toBeNull();
+    const fs = require('fs');
+    const os = require('os');
+    const path = require('path');
+    const { execSync } = require('child_process');
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-banner-'));
+    try {
+      fs.writeFileSync(path.join(dir, 'orig.md'), 'clean body\n');
+      fs.writeFileSync(path.join(dir, 'new.md'), 'body with UNTRUSTED TRACKER CONTENT banner leak\n');
+      const script = block![0]
+        .replaceAll('/tmp/gstack-pr-body-orig-$$.md', path.join(dir, 'orig.md'))
+        .replaceAll('/tmp/gstack-pr-body-$$.md', path.join(dir, 'new.md'));
+      const out = execSync(`bash -c ${JSON.stringify(script + '; true')}`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+      expect(out).not.toContain('banner tripwire clean');
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
   });
 
   test('greptile triage reads bodies through the guard (metadata/body split)', () => {