fix(code-intelligence): consent that means what it says — polarity, receipts, read-only veto

Four review findings on the wave's own Phase 1 port, all red-first:
'consent <repo> no' recorded consent GRANTED (the CLI ignored the
argument and always wrote true) — yes|no is now required and garbage
records nothing; Sourcebot egress receipts claimed consented=true on
paths that never checked consent — the actual consent state is threaded
into every receipt, search is fail-closed on non-loopback, and the
liveness probe's receipt says truthfully that it sends no repo content;
repoPolicyVeto only honored the deny tier while gbrain refresh writes
pages — write-class ops now veto on read-only too, matching the sync
chokepoint, via one shared lib/gbrain-repo-policy-client.ts (win32
bash invocation, spawn-vs-unreadable error distinction) used by both
call sites. Also: source ids get a host+path hash (same-name repos no
longer collide), refresh timeout raised to 120s, availability probes
run concurrently at 3s, graphify status stops JSON.parsing 100MB graphs
for a count, and every ported file carries the fork MIT notice.
+15 tests across the two suites.

lib/code-intelligence/suggest.ts

@@ -1,6 +1,8 @@
 /**
  * suggest — should the session-start indexing offer be made for this repo?
  *
+ * Portions copyright (c) 2026 Sina Matian, time-attack/gstack (GStack 2), MIT.
+ *
  * The offer fires at most once per machine: never when a provider is already
  * selected, never after an explicit decline (`select none`), and never for
  * small repos where grep is already fast. Detection is cheap and local
@@ -11,7 +13,7 @@ import { spawnSync } from "child_process";
 import { resolve } from "path";
 import { readSelection } from "./selection";
 
-// ponytail: single tracked-file-count knob for "large"; add a LOC signal if it misfires
+// Single tracked-file-count knob for "large"; add a LOC signal if it misfires.
 /** Tracked-file count at which indexing starts paying for itself. */
 export const LARGE_REPO_FILE_THRESHOLD = 1000;