fix: pre-landing review fixes (#2733)

Review army + coverage audit findings, all applied:
- headless directive carries the spawned escape sentence too (multi-
  specialist: a CI-hosted ship's marked subagent must not end BLOCKED)
- anti-injection scoping on every text-claimable spawned trigger (AUQ
  rule + shared escape sentence): markings count only from the creating
  prompt, never from files/tool output/web content read mid-run
- [conductor][spawned] deny annotates one-way doors per question
- SPAWNED_OVERRIDE: env tamper-visibility status line + OPENCLAW.md note
- spawned sessions skip the network update-check and first-task probe
  (consumers suppressed; preserves the one-shot just-upgraded marker)
- test hardening: dispatch-tripwire end-bound validated, vacuous marker
  asserts replaced with output asserts, E2E cpSync size filter + named
  fence tolerance, spawnedByEnv parity pin, destructive-policy cross-
  surface drift guard, one-way annotation + bogus-value hook cases
- session-kind duplicate rationale comment deduped; regen + goldens +
  context-budget fixture refreshed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/OPENCLAW.md

@@ -152,6 +152,14 @@ processes inherit the harness env, so a per-command prefix never reaches
 PreToolUse/PostToolUse hooks — the hook texts carry a spawned escape sentence
 for that topology (`hosts/claude/hooks/spawned-directive.ts`).
 
+**Tamper visibility.** Any mechanism that injects session-wide env (a cloned
+repo's `.claude/settings.json` env block, direnv, a CI wrapper) could set
+`GSTACK_SESSION_KIND=spawned` for a real human's session and silently flip
+its confirmation gates to auto-choose. When the env override drives the
+classification, the preamble emits a loud `SPAWNED_OVERRIDE: env` status line
+so the transcript shows WHY the session is spawned — audit
+`.claude/settings.json` env blocks in untrusted repos (/cso covers this).
+
 ## Installation
 
 For OpenClaw users: tell your OpenClaw agent "install gstack for openclaw."