fix: pre-landing review fixes (27 specialist findings, 3 critical)

Specialist army findings, all quote-verified before fixing:

Security: careful force-push guard now catches git's plus-refspec force
syntax (git push origin +main carried force with no flag — silently allowed
before) and refspec-form targets (HEAD:main); default-branch matching is
tokenized FIXED-STRING comparison on the full branch path (slashed defaults
like release/2.0 work; no ERE interpolation), glob-safe via noglob. HIGH rm
tier is tokenized too: trailing long options (--no-preserve-root) and /* are
root-class. Stored evidence fingerprints are 40-hex re-validated before
reaching git argv. normalizeForDetection sweeps ALL Unicode format chars
(\p{Cf}: soft hyphens, bidi marks, tag chars) instead of five enumerated
zero-widths. The wiring scanner gains flagless gh pr/issue view patterns. The
release-body banner tripwire diffs against the fetched original so a hostile
pre-existing banner string can't permanently DoS doc updates. Ship/land
evidence checks now pass --expect-cmd (a green `echo ok` recorded under the
label can never mint FRESH); package.json stays allow-listed with the
residual documented.

Performance: gstack-wtree seeds its temp index by COPYING the real index
(stat cache preserved — measured 40x faster than read-tree seeding, identical
hash) with read-tree fallback; evidence uses findLast and one gstack-slug
spawn; the stream pump honors backpressure via drain; careful's pattern block
short-circuits before slug resolution when no pattern file exists.

Testing: the gh-failure envelope test was VACUOUS (killing PATH killed the
bun shebang before the code under test ran) — replaced with a PATH gh shim
that exercises the real branch, plus shimmed happy paths (issue/pr-body/
unparseable JSON); evidence check --all + empty ledger + non-numeric
--max-age (now a usage error, was silent fail-open) covered; HIGH-tier
variants pinned; hook analytics respect GSTACK_HOME so tests stop writing the
operator's real skill-usage.jsonl.

Maintainability: dead exit ternary removed; flagValue deduped into
bin-context; sentinel defusal derived from the banner constants (no invisible
literals — \u escapes only); scratch-repo git fixture extracted to
test/helpers/scratch-repo.ts (one hermetic incantation, three consumers);
shared gstack_hook_log_fire in hook-extract.sh; the dashboard/land diff-scoped
row lists are aligned (codex-review) and drift-pinned.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/tracker-guard.ts

@@ -46,7 +46,11 @@ export const TRACKER_EXTRA: readonly RegExp[] = [
  * keyword are stripped. The return value is matched, never emitted.
  */
 export function normalizeForDetection(text: string): string {
-  return text.normalize("NFKC").replace(/[​‌‍⁠]/g, "");
+  // Strip ALL Unicode format characters (Cf: zero-widths, bidi marks, soft
+  // hyphens, invisible tag chars) — each can split a keyword to dodge the
+  // label. NFKC runs first, so losing an emoji ZWJ here only affects the
+  // match probe, never the emitted content.
+  return text.normalize("NFKC").replace(/\p{Cf}/gu, "");
 }
 
 /** True when a line (after detection-normalization) matches any pattern. */
@@ -61,11 +65,24 @@ export function lineLooksInjected(line: string): boolean {
  * matches the banner the model anchors on. (Adapted from content-security's
  * escapeEnvelopeSentinels.)
  */
+const ZWSP = "\u200B";
+
+function escapeRegExp(literal: string): string {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Splice a zero-width space through a banner so a forgery no longer matches. */
+function spliceBanner(banner: string): string {
+  const mid = Math.floor(banner.length / 2);
+  return banner.slice(0, mid) + ZWSP + banner.slice(mid);
+}
+
 export function escapeTrackerSentinels(content: string): string {
-  const zwsp = "​";
+  // Derived from the exported constants — editing the banner text cannot
+  // silently decouple the forgery defusal from the envelope.
   return content
-    .replace(/═══ BEGIN UNTRUSTED TRACKER CONTENT ═══/g, `═══ BEGIN UNTRUSTED TRACKER C${zwsp}ONTENT ═══`)
-    .replace(/═══ END UNTRUSTED TRACKER CONTENT ═══/g, `═══ END UNTRUSTED TRACKER C${zwsp}ONTENT ═══`);
+    .replace(new RegExp(escapeRegExp(TRACKER_ENVELOPE_BEGIN), "g"), spliceBanner(TRACKER_ENVELOPE_BEGIN))
+    .replace(new RegExp(escapeRegExp(TRACKER_ENVELOPE_END), "g"), spliceBanner(TRACKER_ENVELOPE_END));
 }
 
 /**