fix(hooks): spawned-session escape in Conductor AUQ deny; override coverage in AUQ-error fallback (#2733)

Hooks inherit the harness env, so a per-command GSTACK_SESSION_KIND
prefix inside a subagent's bash can never reach them. Levers added:
a deterministic [conductor][spawned] auto-choose deny for env-level
spawned sessions (OPENCLAW_SESSION or session-wide GSTACK_SESSION_KIND),
and a spawned escape sentence appended to both hooks' prose directives
so a marked subagent that slips and calls AUQ resolves to auto-choose
instead of prose-STOP. The sentence lives in one shared constant
(hosts/claude/hooks/spawned-directive.ts) so the two paths can never
drift; destructive semantics are unified to conservative-continue.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/claude/hooks/spawned-directive.ts

@@ -0,0 +1,47 @@
+/**
+ * Shared spawned-session directive text for the AUQ hooks (#2733).
+ *
+ * Hook processes inherit the HARNESS env, so a per-command
+ * `GSTACK_SESSION_KIND=spawned` prefix inside a subagent's bash call can
+ * never reach a hook — the only levers a hook has for the subagent case are
+ * (a) env-level markers that ARE session-wide (OPENCLAW_SESSION, or a harness
+ * launched with GSTACK_SESSION_KIND in its env) and (b) directive TEXT the
+ * model reads. Both AUQ hooks (question-preference PreToolUse deny,
+ * auq-error-fallback PostToolUse directive) carry the same escape sentence;
+ * it lives here as one constant so the two paths can never drift into
+ * contradictory instructions.
+ *
+ * Destructive semantics are unified across every spawned surface (dispatch
+ * prompt, spawned-session block, AUQ prose rule, both hooks):
+ * conservative-continue, never prose-STOP — a prose brief with no reader is
+ * always wrong in a spawned session, and the conservative choice guarantees
+ * nothing irreversible happens.
+ */
+
+/** Appended to prose-directing hook texts so a marked subagent that slips
+ *  and calls AUQ still resolves to auto-choose instead of prose-STOP. */
+export const SPAWNED_ESCAPE_SENTENCE =
+  'If this session was spawned by an orchestrator or a parent agent and no human reads its ' +
+  'output mid-run (e.g. your dispatch prompt says you are a spawned subagent), do not render ' +
+  'the prose brief either — auto-choose the recommended option and continue; at a destructive ' +
+  'or irreversible gate, do not execute the destructive action: take the conservative ' +
+  'non-destructive choice (skip/defer), record it, and continue.';
+
+/** Deterministic deny reason for env-detected spawned sessions inside Conductor. */
+export const CONDUCTOR_SPAWNED_DENY_REASON =
+  '[conductor][spawned] AskUserQuestion is unreliable in Conductor and this session is ' +
+  'orchestrator-spawned — no human reads its output. Do NOT retry the tool and do NOT render ' +
+  'a prose decision brief: auto-choose the recommended option for each question above, note ' +
+  'the choice, and continue the workflow. Exception: never auto-approve a destructive or ' +
+  'irreversible option — take the conservative non-destructive choice (skip/defer), note it, ' +
+  'and continue.';
+
+/**
+ * Env-level spawned detection (direct env read — PreToolUse hot path, no
+ * shell-out). Mirrors bin/gstack-session-kind steps 0-1. True only for
+ * session-wide markers; a per-command prefix in subagent bash is invisible
+ * here by construction.
+ */
+export function spawnedByEnv(env: NodeJS.ProcessEnv = process.env): boolean {
+  return !!env.OPENCLAW_SESSION || env.GSTACK_SESSION_KIND === 'spawned';
+}