fix: pre-landing review round — 8 auto-fixes + 8 accepted findings hardened

The ship review army (4 specialists + red-team + checklist, 29 findings)
produced 8 mechanical auto-fixes and 11 decisions; the accepted set:

- win32 slug parity completed: lib/bin-context.ts gains the remote-first
  outermost walk + degraded-cache self-heal the bash side got this wave —
  the two implementations now agree on the stray-marker live-bug shape,
  pinned by shared fixtures (multi-specialist 9/10 finding).
- probe honors the plan's bounded-read decision: 256KB prefix, extraction
  semantics mirrored from parseTranscriptJsonl so probe/prepare can never
  diverge on the same file (>1MB transcript test).
- policy normalize parity: bash normalize() now matches canonicalizeRemote
  on .git/-trailing and uppercase-.GIT shapes (7-shape corpus pinned two
  ways) — a deny for those shapes could previously slip the transcript gate.
- session-update reclaim is TOCTOU-safe (atomic mv-aside on both branches).
- settings-hook: unparseable settings.json errors instead of being replaced
  with {}; ensure-event keys on (event, source) so matcher changes update
  in place — never zero or two registrations.
- dot-only slug guard at both parse sites (hostile 'url = ..' can't escape
  projects/); enqueue tmp-file janitor (1h TTL, inside the drain lock);
  brain-sync .migrating never clobbered; drop-queue/status count .migrating;
  snapshot -o warning correct + surfaced in diff mode; version-bump test
  order-dependence removed; uninstall clears the advance stamp.

Deferred with record: slug heal-probe cost sentinel (P3 TODO), FF_OK
conflation (noted, misdiagnosis-only).

270 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/session-update-autostash.test.ts

@@ -234,6 +234,23 @@ describe('gstack-session-update lock identity + TTL (#2613)', () => {
     }
   }, 30000);
 
+  test('reclaim is TOCTOU-safe: both reclaim branches mv the lock aside atomically (static pin)', () => {
+    // `rm -rf "$LOCK_DIR"` then `mkdir` lets TWO contenders both judge the
+    // lock stale and both win (one rm can land between the other's rm and
+    // mkdir). The atomic mv-aside makes exactly one contender own the reap:
+    // the loser's mv fails and it backs off with SKIP lock_contested. Pin
+    // that BOTH reclaim branches (TTL-expired and dead-PID) use it, and that
+    // no bare in-place `rm -rf "$LOCK_DIR"` survives outside the holder's
+    // own EXIT trap.
+    const src = fs.readFileSync(SCRIPT, 'utf8');
+    const mvAside = src.match(/mv "\$LOCK_DIR" "\$LOCK_DIR\.reap\.\$\$" 2>\/dev\/null \|\| \{ log_entry "SKIP lock_contested"; exit 0; \}/g) || [];
+    expect(mvAside.length).toBe(2); // TTL branch + dead-PID branch
+    // The only rm -rf of the live lock dir is the holder's EXIT trap.
+    const bareRms = src.match(/rm -rf "\$LOCK_DIR"(?!\.)/g) || [];
+    expect(bareRms.length).toBe(1);
+    expect(src).toContain(`trap 'rm -rf "$LOCK_DIR" 2>/dev/null' EXIT`);
+  });
+
   test('an expired-TTL lock is reclaimed even when its pid is alive (PID reuse)', async () => {
     const { base, install, state } = makeFixture();
     const holder = require('child_process').spawn('sleep', ['30'], { stdio: 'ignore' });