plan-ceo-review, plan-eng-review: storage paths follow the state root (s04 F2, s04 F3)

The CEO storage policy and the eng write policy named ~/.gstack/projects/ and
~/.gstack/analytics/, while the writers (tasks-section.ts, testing.ts,
spec-review.ts) use $GSTACK_STATE_ROOT. When the state root is relocated the
prose pointed at the wrong directory.

W7a pin: test/plan-review-cases.test.ts:852 pinned the stale path; it now
checks the discovery path is under $GSTACK_STATE_ROOT and that the hardcoded
~/.gstack/projects/{slug}/ is gone. expected red until the regeneration commit

test/plan-review-cases.test.ts

@@ -849,7 +849,9 @@ describe('Eng approved-work decision gate', () => {
     expect(compactProse(policy)).toContain("adding a suffix on collision");
     expect(compactProse(policy)).toContain("Never substitute an unrelated active plan");
     expect(compactProse(policy)).toContain("ledger and final structured report");
-    expect(compactProse(policy)).toContain('QA Test Plan/task JSONL keep discovery paths `~/.gstack/projects/{slug}/`');
+    // Discovery paths follow the writers' state root (testing.ts, tasks-section.ts), never a hardcoded home.
+    expect(compactProse(policy)).toMatch(/discovery paths `\$GSTACK_STATE_ROOT\/projects\/\{slug\}\/`/);
+    expect(compactProse(policy)).not.toContain('~/.gstack/projects/{slug}/');
     expect(compactProse(policy)).toContain("including active-plan-only");
     expect(compactProse(policy)).toContain("**Check each artifact and parent directory's permission before writing.**");
     expect(compactProse(policy)).toContain("Permission for one path authorizes no other");