fix(sandbox-doctor): loud on git-shim patch drift; document the retry-contract override

- The /conductor/bin/git patch was a silent no-op if the shim's bytes drift
  from the exact pattern — now warns that laundering is NOT fixed.
- The bashrc block documents why GSTACK_FREE_RETRY_FLAKY=1 deliberately
  overrides the runner's default-OFF contract on this sandbox, and how to
  undo it.
- Test pins the guarded shm form (missing /dev/shm must not abort set -eu).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/sandbox-doctor-shell.test.ts

@@ -28,5 +28,6 @@ describe('sandbox-doctor.sh', () => {
     expect(src).toContain('git config --global user.name >/dev/null 2>&1 ||'); // never clobber identity
     expect(src).toContain("grep -q 'GSTACK sandbox test env'");      // bashrc seeded once
     expect(src).toContain('command -v Xvfb >/dev/null 2>&1 ||');     // install only if absent
+    expect(src).toContain('[ "${shm_kb:-0}" -gt 0 ]');               // missing /dev/shm: skip, not a set -eu abort
   });
 });