fix(test): adversarial findings — stable root key, symlink-alias dedupe, fixture-shape guard

Adversarial review (Claude subagent) verified the fixture's root-skill key was
the capture machine's checkout dirname: any non-gstack-named clone (every
Conductor worktree) failed the free suite, and the documented re-run-the-capture
recovery baked the local dirname into the committed fixture — silent corruption
through the tool's own protocol. The root skill is now pinned to ROOT_SKILL_KEY
('gstack', its frontmatter name). Symlink aliases are realpath-deduped (census
precedent): connect-chrome no longer gets its own ceiling, so Windows checkouts
that materialize the symlink as a plain file can't fail the stale-ceiling
set-equality test. New guards: fixture-shape validation (a string alwaysOnTotal
can no longer silently disable the ceiling), a mutation pin that the filter
shrinks the always-on ledger vs the raw bill, an alwaysOnTotal violation test
(the branch was load-bearing with only under-budget coverage), and an atomic
temp+rename fixture write. Fixture regenerated: 59 ceilings, alwaysOnTotal 6344.
Deferred with a TODO: anchoring transformFrontmatter's denylist strip to the
frontmatter block (latent, zero live collisions, pre-existing path).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/context-bill.test.ts

@@ -419,6 +419,18 @@ describe("--budget", () => {
     expect(violations).toHaveLength(1);
     expect(violations[0].ceiling).toBe("eagerPerInvocation.ghost");
   });
+
+  // The context-budget ratchet (test/context-budget-ratchet.test.ts) made
+  // this branch load-bearing in CI; it previously had only under-budget
+  // coverage.
+  it("checkBudget flags an alwaysOnTotal violation with every skill's frontmatter listed", () => {
+    const bill = buildBill(TREE_A);
+    const violations = checkBudget(bill, { alwaysOnTotal: 0 });
+    expect(violations).toHaveLength(1);
+    expect(violations[0].ceiling).toBe("alwaysOnTotal");
+    expect(violations[0].actual).toBe(Math.round(bill.totals.alwaysOnTokens));
+    expect(violations[0].files.length).toBe(bill.skills.length);
+  });
 });
 
 describe("--exact (opt-in measurement; offline here via an injected fetch)", () => {