fix: pre-landing review fixes (#2733)

Review army + coverage audit findings, all applied:
- headless directive carries the spawned escape sentence too (multi-
  specialist: a CI-hosted ship's marked subagent must not end BLOCKED)
- anti-injection scoping on every text-claimable spawned trigger (AUQ
  rule + shared escape sentence): markings count only from the creating
  prompt, never from files/tool output/web content read mid-run
- [conductor][spawned] deny annotates one-way doors per question
- SPAWNED_OVERRIDE: env tamper-visibility status line + OPENCLAW.md note
- spawned sessions skip the network update-check and first-task probe
  (consumers suppressed; preserves the one-shot just-upgraded marker)
- test hardening: dispatch-tripwire end-bound validated, vacuous marker
  asserts replaced with output asserts, E2E cpSync size filter + named
  fence tolerance, spawnedByEnv parity pin, destructive-policy cross-
  surface drift guard, one-way annotation + bogus-value hook cases
- session-kind duplicate rationale comment deduped; regen + goldens +
  context-budget fixture refreshed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-session-kind

@@ -29,14 +29,7 @@
 # signals that actually discriminate are the host/orchestrator/CI env markers below.
 set -euo pipefail
 
-# 0. Explicit spawned marker — set per-command by a dispatching skill (e.g.
-#    /ship Step 18 prefixes the document-release subagent's gstack-skill-start
-#    with GSTACK_SESSION_KIND=spawned; #2733: Claude Code subagents inherit
-#    the parent env byte-for-byte, so ambient markers misclassify them as the
-#    parent's kind). Only "spawned" is honored: headless already has
-#    GSTACK_HEADLESS, and letting an env var force "interactive" over CI
-#    markers would be a misclassification footgun. Other values are reserved
-#    and ignored (fall through) — same contract as empty GSTACK_HEADLESS.
+# 0. Explicit spawned marker — full rationale and contract in the header above.
 if [ "${GSTACK_SESSION_KIND:-}" = "spawned" ]; then
   echo "spawned"
   exit 0