fix: pre-landing review fixes (27 specialist findings, 3 critical)

Specialist army findings, all quote-verified before fixing:

Security: careful force-push guard now catches git's plus-refspec force
syntax (git push origin +main carried force with no flag — silently allowed
before) and refspec-form targets (HEAD:main); default-branch matching is
tokenized FIXED-STRING comparison on the full branch path (slashed defaults
like release/2.0 work; no ERE interpolation), glob-safe via noglob. HIGH rm
tier is tokenized too: trailing long options (--no-preserve-root) and /* are
root-class. Stored evidence fingerprints are 40-hex re-validated before
reaching git argv. normalizeForDetection sweeps ALL Unicode format chars
(\p{Cf}: soft hyphens, bidi marks, tag chars) instead of five enumerated
zero-widths. The wiring scanner gains flagless gh pr/issue view patterns. The
release-body banner tripwire diffs against the fetched original so a hostile
pre-existing banner string can't permanently DoS doc updates. Ship/land
evidence checks now pass --expect-cmd (a green `echo ok` recorded under the
label can never mint FRESH); package.json stays allow-listed with the
residual documented.

Performance: gstack-wtree seeds its temp index by COPYING the real index
(stat cache preserved — measured 40x faster than read-tree seeding, identical
hash) with read-tree fallback; evidence uses findLast and one gstack-slug
spawn; the stream pump honors backpressure via drain; careful's pattern block
short-circuits before slug resolution when no pattern file exists.

Testing: the gh-failure envelope test was VACUOUS (killing PATH killed the
bun shebang before the code under test ran) — replaced with a PATH gh shim
that exercises the real branch, plus shimmed happy paths (issue/pr-body/
unparseable JSON); evidence check --all + empty ledger + non-numeric
--max-age (now a usage error, was silent fail-open) covered; HIGH-tier
variants pinned; hook analytics respect GSTACK_HOME so tests stop writing the
operator's real skill-usage.jsonl.

Maintainability: dead exit ternary removed; flagValue deduped into
bin-context; sentinel defusal derived from the banner constants (no invisible
literals — \u escapes only); scratch-repo git fixture extracted to
test/helpers/scratch-repo.ts (one hermetic incantation, three consumers);
shared gstack_hook_log_fire in hook-extract.sh; the dashboard/land diff-scoped
row lists are aligned (codex-review) and drift-pinned.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/evidence.test.ts

@@ -10,8 +10,10 @@ const EVIDENCE = path.join(ROOT, 'bin', 'gstack-evidence');
 let gstackHome: string;
 let repoDir: string;
 
+import { gitIn, findFilesBySuffix } from './helpers/scratch-repo';
+
 function git(args: string) {
-  execSync(`git -c user.email=t@test -c user.name=t -c commit.gpgsign=false -c tag.gpgsign=false ${args}`, { cwd: repoDir, encoding: 'utf-8', timeout: 10000 });
+  gitIn(repoDir, args);
 }
 
 function run(args: string[], opts: { cwd?: string } = {}): { status: number; stdout: string; stderr: string } {
@@ -26,16 +28,7 @@ function run(args: string[], opts: { cwd?: string } = {}): { status: number; std
 }
 
 function ledgerFile(): string {
-  const found: string[] = [];
-  const walk = (d: string) => {
-    if (!fs.existsSync(d)) return;
-    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
-      const p = path.join(d, e.name);
-      if (e.isDirectory()) walk(p);
-      else if (e.name.endsWith('-evidence.jsonl')) found.push(p);
-    }
-  };
-  walk(path.join(gstackHome, 'projects'));
+  const found = findFilesBySuffix(path.join(gstackHome, 'projects'), '-evidence.jsonl');
   expect(found.length).toBeGreaterThan(0);
   return found[0];
 }
@@ -115,7 +108,7 @@ describe('gstack-evidence run', () => {
     expect(fs.statSync(rec.log_path).mode & 0o777).toBe(0o600);
   });
 
-  test('two rapid runs get distinct log files (collision-safe exclusive open)', () => {
+  test('two rapid runs get distinct per-run log files', () => {
     run(['run', '--label', 'tests', '--', 'echo one']);
     run(['run', '--label', 'tests', '--', 'echo two']);
     const [a, b] = records().slice(-2);
@@ -272,6 +265,26 @@ describe('gstack-evidence check', () => {
     expect(chk.stdout).toContain('MISSING label=never-ran');
   });
 
+  test('check --all grades every recorded label; empty ledger is MISSING', () => {
+    const empty = run(['check', '--all']);
+    expect(empty.status).toBe(1);
+    expect(empty.stdout).toContain('ledger empty');
+
+    expect(run(['run', '--label', 'a', '--', 'echo ok']).status).toBe(0);
+    run(['run', '--label', 'b', '--', 'exit 1']);
+    const chk = run(['check', '--all']);
+    expect(chk.status).toBe(1);
+    expect(chk.stdout).toContain('label=a');
+    expect(chk.stdout).toContain('label=b');
+  });
+
+  test('non-numeric --max-age is a usage error, never a silent fail-open', () => {
+    expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
+    const chk = run(['check', '--label', 'tests', '--max-age', '24h']);
+    expect(chk.status).toBe(2);
+    expect(chk.stderr).toContain('positive number');
+  });
+
   test('check never errors outside a git repo — degrades to STALE', () => {
     expect(run(['run', '--label', 'tests', '--', 'echo green']).status).toBe(0);
     const nonGit = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-evidence-nongit-'));