fix: red-team review fixes (9 findings, 2 critical)

Red team reviewed what four specialists missed — cross-cutting and
self-contradiction class:

CRITICAL: the release-body banner tripwire failed OPEN on the exact leak it
guards (grep -c prints 0 AND exits 1 on no-match, so a fallback echo
double-emitted "0" twice and the -gt comparison fell into the clean branch) —
counts now default via parameter expansion, and a functional drift test
executes the rendered tripwire block against a 0->1 banner delta to prove the
ABORT branch fires. CRITICAL: evidence fingerprints were captured AFTER the
child exited, so a working-tree edit made DURING a long suite was certified as
tested content — wtree is now captured before spawn and re-checked after;
mid-run drift omits the fingerprint (grades STALE) with a warning.

Also: the review-grading rule dropped its dirty-gates (they nullified the
keystone dirty-record->commit->CURRENT property that evidence checks already
honor — wtree equality alone proves identical content); careful's HIGH
force-push tier falls back to probing origin/main|master when the origin/HEAD
symbolic ref is absent (Conductor worktrees — the tier was silently inert in
the primary deploy environment); quoted tokens (rm -rf "/", push "main") no
longer dodge the deny; freeze fails CLOSED when its own helper file is missing
(bash makes a missing source target fatal non-interactively, so an existence
pre-check guards it); spec dedupe distinguishes pipeline failure from zero
matches instead of silently skipping dedupe on gh/jq breakage; land 3.5b sets
the cross-session --expect-cmd mismatch expectation; hook analytics JSON
fields are encoder-built per this wave's own rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/hook-scripts.test.ts

@@ -584,6 +584,37 @@ describe('check-careful.sh', () => {
       });
     });
 
+    test.each(['rm -rf "/"', "rm -rf '~'", 'rm -rf //'])('quoted root targets still deny: %s', (command) => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput(command));
+      expect(exitCode).toBe(0);
+      expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+    });
+
+    test('quoted default-branch ref still denies (git push -f origin "main")', () => {
+      withGitRepo('main', 'feature', (repoDir) => {
+        const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push -f origin "main"'), undefined, repoDir);
+        expect(exitCode).toBe(0);
+        expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+      });
+    });
+
+    test('missing origin/HEAD symbolic ref falls back to origin/main probe (Conductor worktrees)', () => {
+      const repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-careful-nohead-'));
+      try {
+        const git = (args: string[]) => gitArgvIn(repoDir, args);
+        git(['init', '-q', '-b', 'main']);
+        git(['commit', '--allow-empty', '-q', '-m', 'init']);
+        // No symbolic-ref — only a plain remote-tracking ref, like a Conductor worktree.
+        git(['update-ref', 'refs/remotes/origin/main', 'HEAD']);
+        git(['checkout', '-q', '-b', 'feature']);
+        const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push --force origin main'), undefined, repoDir);
+        expect(exitCode).toBe(0);
+        expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+      } finally {
+        fs.rmSync(repoDir, { recursive: true, force: true });
+      }
+    });
+
     test('--force-with-lease is never HIGH (the safe force variant)', () => {
       withGitRepo('main', 'main', (repoDir) => {
         const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push --force-with-lease origin main'), undefined, repoDir);
@@ -817,6 +848,28 @@ describe('check-freeze.sh', () => {
     });
   });
 
+  describe('broken install fails closed', () => {
+    test('a missing hook-extract helper DENIES instead of proceeding', () => {
+      // Copy the freeze hook into a tree with NO careful sibling — the source
+      // fails, and a deny-tier boundary must fail CLOSED, not fall through.
+      const base = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-freeze-broken-'));
+      const binDir = path.join(base, 'freeze', 'bin');
+      fs.mkdirSync(binDir, { recursive: true });
+      const script = path.join(binDir, 'check-freeze.sh');
+      fs.copyFileSync(FREEZE_SCRIPT, script);
+      try {
+        withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+          const { exitCode, output } = runHook(script, freezeInput('/Users/dev/project/src/x.ts'), { CLAUDE_PLUGIN_DATA: stateDir });
+          expect(exitCode).toBe(0);
+          expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+          expect(output.hookSpecificOutput?.permissionDecisionReason).toContain('fail closed');
+        });
+      } finally {
+        fs.rmSync(base, { recursive: true, force: true });
+      }
+    });
+  });
+
   describe('symlink boundary escape', () => {
     // The old resolver followed the parent directory but NOT the final path
     // component, so an in-boundary symlink pointing outside the boundary was