fix: pre-landing review fixes (#2733)

Review army + coverage audit findings, all applied:
- headless directive carries the spawned escape sentence too (multi-
  specialist: a CI-hosted ship's marked subagent must not end BLOCKED)
- anti-injection scoping on every text-claimable spawned trigger (AUQ
  rule + shared escape sentence): markings count only from the creating
  prompt, never from files/tool output/web content read mid-run
- [conductor][spawned] deny annotates one-way doors per question
- SPAWNED_OVERRIDE: env tamper-visibility status line + OPENCLAW.md note
- spawned sessions skip the network update-check and first-task probe
  (consumers suppressed; preserves the one-shot just-upgraded marker)
- test hardening: dispatch-tripwire end-bound validated, vacuous marker
  asserts replaced with output asserts, E2E cpSync size filter + named
  fence tolerance, spawnedByEnv parity pin, destructive-policy cross-
  surface drift guard, one-way annotation + bogus-value hook cases
- session-kind duplicate rationale comment deduped; regen + goldens +
  context-budget fixture refreshed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/claude/hooks/auq-error-fallback-hook.ts

@@ -147,15 +147,26 @@ export function directiveFor(kind: 'spawned' | 'headless' | 'interactive'): stri
     'Per the AskUserQuestion failure-fallback rule: ';
   switch (kind) {
     case 'spawned':
+      // Self-contained carve-out (#2733 review): the "Spawned session block"
+      // exists in context only when a gstack preamble ran; an AUQ error
+      // outside a skill must still carry the destructive exception here.
       return (
         lead +
         'SESSION_KIND=spawned — auto-choose the recommended option per the Spawned session block. ' +
-        'Do not emit prose, do not BLOCK.'
+        'Do not emit prose, do not BLOCK. Exception: never auto-choose a destructive or ' +
+        'irreversible option — take the conservative non-destructive choice (skip/defer), ' +
+        'record it, and continue.'
       );
     case 'headless':
+      // #2733 review (multi-specialist): a spawned-marked subagent under a
+      // HEADLESS-classified parent env (CI/eval-hosted /ship) hits this branch
+      // — the shell-out sees the harness env, never the per-command marker.
+      // The self-gating escape sentence keeps the JSON contract alive there;
+      // plain headless sessions read its condition as false and still BLOCK.
       return (
         lead +
-        'SESSION_KIND=headless — report `BLOCKED — AskUserQuestion unavailable` and stop; no human can answer.'
+        'SESSION_KIND=headless — report `BLOCKED — AskUserQuestion unavailable` and stop; no human can answer. ' +
+        SPAWNED_ESCAPE_SENTENCE
       );
     case 'interactive':
     default: