fix: adversarial review fixes (Claude pass, 14 findings, 1 verified-live critical)

The fresh-context adversarial pass caught a live bug in this branch's own
performance fix: gstack-wtree exported GIT_INDEX_FILE BEFORE resolving the
real index path, so `git rev-parse --git-path index` returned the temp index
itself, the stat-cache copy self-copied and failed, and every invocation fell
back to the full re-hash — the fast path was dead code (verified with bash -x).
Resolution now happens before the export; measured 0.08s per call on this repo.

Also fixed: careful fails to an ASK (not silence) when its own helper file is
missing (same partial-install state freeze already defends against); the
--source label is sanitized inside the envelope lib (newline-stripped,
sentinel-defused, length-capped — it sits in trusted framing); the HIGH rm
tokenizer skips redirections/backgrounding/`--` (rm -rf / 2>/dev/null now
denies) and knows ${HOME}; user pattern lines starting with a dash work
(grep --); greptile bodies carry per-comment id headers inside the envelope so
multi-comment PRs stay attributable (ids verified against raw metadata, never
trusted in-body); the release-body tripwire fails CLOSED when its input files
are missing (separate-shell $$ reality); land 3.5b gets the same allow-paths
as ship; the "either side dirty" fallback leftover is gone from both grading
surfaces; the evidence pump races drain against error (EPIPE consumers can't
hang the wrapper); an unset HOME skips bookkeeping instead of creating a
literal ~ dir inside the repo; a write-failure log ends with a visible marker;
freeze expands a literal leading ~ in the boundary; review-log documents its
log-time binding window.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

document-release/sections/release-body.md

@@ -288,6 +288,14 @@ reach the live PR/MR. If the composed section leaked it, ABORT the update:
 # to it would DOUBLE-EMIT ("0" twice) and break the -gt comparison into the
 # clean branch, failing open on the exact leak this guards. Default only the
 # missing-file case via parameter expansion.
+# Each bash block runs in a separate shell, so $$ differs BETWEEN blocks —
+# run the fetch, splice, scan, tripwire, and edit in ONE shell (or replace $$
+# with an explicit filename you carry through). The tripwire fails CLOSED on
+# missing files rather than counting zeros on paths that don't exist.
+if [ ! -f /tmp/gstack-pr-body-orig-$$.md ] || [ ! -f /tmp/gstack-pr-body-$$.md ]; then
+  echo "ABORT: tripwire inputs missing — the fetch and the write-back ran in different shells (\$\$ changed). Re-run fetch through edit in one bash block." >&2
+  false
+fi
 _ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null)
 _ORIG_BANNERS=${_ORIG_BANNERS:-0}
 _NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null)

document-release/sections/release-body.md.tmpl

@@ -286,6 +286,14 @@ reach the live PR/MR. If the composed section leaked it, ABORT the update:
 # to it would DOUBLE-EMIT ("0" twice) and break the -gt comparison into the
 # clean branch, failing open on the exact leak this guards. Default only the
 # missing-file case via parameter expansion.
+# Each bash block runs in a separate shell, so $$ differs BETWEEN blocks —
+# run the fetch, splice, scan, tripwire, and edit in ONE shell (or replace $$
+# with an explicit filename you carry through). The tripwire fails CLOSED on
+# missing files rather than counting zeros on paths that don't exist.
+if [ ! -f /tmp/gstack-pr-body-orig-$$.md ] || [ ! -f /tmp/gstack-pr-body-$$.md ]; then
+  echo "ABORT: tripwire inputs missing — the fetch and the write-back ran in different shells (\$\$ changed). Re-run fetch through edit in one bash block." >&2
+  false
+fi
 _ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null)
 _ORIG_BANNERS=${_ORIG_BANNERS:-0}
 _NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null)