fix(sandbox-doctor): loud on git-shim patch drift; document the retry-contract override

- The /conductor/bin/git patch was a silent no-op if the shim's bytes drift
  from the exact pattern — now warns that laundering is NOT fixed.
- The bashrc block documents why GSTACK_FREE_RETRY_FLAKY=1 deliberately
  overrides the runner's default-OFF contract on this sandbox, and how to
  undo it.
- Test pins the guarded shm form (missing /dev/shm must not abort set -eu).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/sandbox-doctor.sh

@@ -73,6 +73,12 @@ new = 'exit 0\nelse\n\tstatus=$?\nfi'
 if old in src:
     open('/conductor/bin/git', 'w').write(src.replace(old, new))
     print('sandbox-doctor: patched /conductor/bin/git exit-code laundering')
+elif 'else\n\tstatus=$?\nfi' not in src:
+    # Loud on format drift: the outer guard matched but the byte-exact patch
+    # pattern did not — silence here would read as "fixed" while phantom git
+    # successes persist.
+    print('sandbox-doctor: WARNING /conductor/bin/git matched the laundering guard '
+          'but not the patch pattern — exit-code laundering NOT fixed; patch it by hand')
 EOF
 fi
 
@@ -81,6 +87,11 @@ if ! grep -q 'GSTACK sandbox test env' "$HOME/.bashrc" 2>/dev/null; then
   cat >> "$HOME/.bashrc" <<'EOF'
 
 # GSTACK sandbox test env (written by scripts/sandbox-doctor.sh)
+# NOTE: GSTACK_FREE_RETRY_FLAKY=1 deliberately overrides the runner's
+# default-OFF contract ("dev boxes should see flakes, not absorb them") —
+# this sandbox's seccomp supervisor injects spurious one-off failures under
+# load, which the serial retry absorbs while still failing on reproducible
+# breakage. Delete this block from ~/.bashrc to restore the default.
 export TMPDIR="$HOME/tmp"
 export GSTACK_FREE_JOBS=2
 export GSTACK_FREE_RETRY_FLAKY=1

test/sandbox-doctor-shell.test.ts

@@ -28,5 +28,6 @@ describe('sandbox-doctor.sh', () => {
     expect(src).toContain('git config --global user.name >/dev/null 2>&1 ||'); // never clobber identity
     expect(src).toContain("grep -q 'GSTACK sandbox test env'");      // bashrc seeded once
     expect(src).toContain('command -v Xvfb >/dev/null 2>&1 ||');     // install only if absent
+    expect(src).toContain('[ "${shm_kb:-0}" -gt 0 ]');               // missing /dev/shm: skip, not a set -eu abort
   });
 });