fix(code-intelligence): consent that means what it says — polarity, receipts, read-only veto

Four review findings on the wave's own Phase 1 port, all red-first:
'consent <repo> no' recorded consent GRANTED (the CLI ignored the
argument and always wrote true) — yes|no is now required and garbage
records nothing; Sourcebot egress receipts claimed consented=true on
paths that never checked consent — the actual consent state is threaded
into every receipt, search is fail-closed on non-loopback, and the
liveness probe's receipt says truthfully that it sends no repo content;
repoPolicyVeto only honored the deny tier while gbrain refresh writes
pages — write-class ops now veto on read-only too, matching the sync
chokepoint, via one shared lib/gbrain-repo-policy-client.ts (win32
bash invocation, spawn-vs-unreadable error distinction) used by both
call sites. Also: source ids get a host+path hash (same-name repos no
longer collide), refresh timeout raised to 120s, availability probes
run concurrently at 3s, graphify status stops JSON.parsing 100MB graphs
for a count, and every ported file carries the fork MIT notice.
+15 tests across the two suites.

lib/code-intelligence/contract.ts

@@ -1,6 +1,8 @@
 /**
  * code-intelligence/contract — the OPTIONAL, repo-oriented provider contract.
  *
+ * Portions copyright (c) 2026 Sina Matian, time-attack/gstack (GStack 2), MIT.
+ *
  * gstack does not maintain a home-grown indexer. It defines this small contract
  * and external providers (GBrain, Sourcebot, Graphify) implement it. The whole
  * contract is OPTIONAL: when no provider is available/consented,
@@ -17,6 +19,16 @@
 
 export type CodeProviderId = "gbrain" | "sourcebot" | "graphify";
 
+/**
+ * Policy op classification for the per-remote trust-tier veto (selection.ts).
+ * Write-class ops (register_source / index / refresh / add / delete) cause
+ * pages to be written, so BOTH `deny` and `read-only` tiers veto them — the
+ * same semantics as runCodeImport in bin/gstack-gbrain-sync.ts ("code ingest
+ * writes pages"). Read-class ops (search / export / status) write nothing, so
+ * only `deny` vetoes them. Callers that don't say get "write" — fail-closed.
+ */
+export type OpClass = "read" | "write";
+
 export type CodeProviderCapability =
   | "register_source"
   | "refresh"
@@ -72,16 +84,18 @@ export interface CodeSearchHit {
 
 export interface OpOptions {
   /**
-   * Env override for spawned processes. Production callers leave this unset;
-   * tests inject a synthetic env (fake CLI on PATH). Matches the existing
-   * gbrain helpers.
+   * Env override for spawned processes and egress-receipt home resolution.
+   * Production callers leave this unset; tests inject a synthetic env (fake
+   * CLI on PATH, temp GSTACK_HOME). Matches the existing gbrain helpers.
    */
   env?: NodeJS.ProcessEnv;
   /** Timeout in ms for the underlying op. */
   timeout?: number;
   /**
    * Explicit per-repo consent that repo content may leave the machine. Required
-   * for non-local providers on register_source / refresh / add.
+   * for non-local providers on register_source / refresh / add / search (the
+   * search query text is repo-derived content). The recorded value also feeds
+   * the egress receipt, which attests the ACTUAL consent state — never assumed.
    */
   consented?: boolean;
 }