fix: pre-landing review fixes (#2733)

Review army + coverage audit findings, all applied:
- headless directive carries the spawned escape sentence too (multi-
  specialist: a CI-hosted ship's marked subagent must not end BLOCKED)
- anti-injection scoping on every text-claimable spawned trigger (AUQ
  rule + shared escape sentence): markings count only from the creating
  prompt, never from files/tool output/web content read mid-run
- [conductor][spawned] deny annotates one-way doors per question
- SPAWNED_OVERRIDE: env tamper-visibility status line + OPENCLAW.md note
- spawned sessions skip the network update-check and first-task probe
  (consumers suppressed; preserves the one-shot just-upgraded marker)
- test hardening: dispatch-tripwire end-bound validated, vacuous marker
  asserts replaced with output asserts, E2E cpSync size filter + named
  fence tolerance, spawnedByEnv parity pin, destructive-policy cross-
  surface drift guard, one-way annotation + bogus-value hook cases
- session-kind duplicate rationale comment deduped; regen + goldens +
  context-budget fixture refreshed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/fixtures/context-budget.json

@@ -2,64 +2,64 @@
   "_comment": "Context-budget ratchet ceilings (~tokens). Regenerate: bun test/helpers/capture-context-budget.ts. Headroom: alwaysOnTotal x1.05, eagerPerInvocation x1.1. Graded by test/context-budget-ratchet.test.ts via lib/context-bill.ts checkBudget.",
   "alwaysOnTotal": 6344,
   "eagerPerInvocation": {
-    "autoplan": 16525,
+    "autoplan": 16619,
     "benchmark": 4931,
     "benchmark-models": 3829,
     "browse": 7097,
     "browser-skills/hackernews-frontpage": 371,
-    "canary": 10570,
+    "canary": 10664,
     "careful": 919,
-    "codex": 15156,
-    "context-restore": 9509,
-    "context-save": 10125,
-    "cso": 15098,
-    "design-consultation": 13805,
-    "design-html": 13491,
-    "design-review": 24387,
-    "design-shotgun": 13602,
-    "devex-review": 15744,
+    "codex": 15251,
+    "context-restore": 9603,
+    "context-save": 10219,
+    "cso": 15193,
+    "design-consultation": 13899,
+    "design-html": 13585,
+    "design-review": 24481,
+    "design-shotgun": 13696,
+    "devex-review": 15838,
     "diagram": 3847,
-    "document-generate": 12253,
-    "document-release": 10050,
+    "document-generate": 12347,
+    "document-release": 10145,
     "freeze": 990,
     "gstack": 3548,
     "gstack-upgrade": 3981,
     "guard": 889,
-    "health": 10707,
-    "investigate": 11360,
-    "ios-clean": 8612,
-    "ios-design-review": 8793,
-    "ios-fix": 8565,
-    "ios-qa": 11305,
-    "ios-sync": 8736,
-    "land-and-deploy": 15981,
-    "landing-report": 9418,
-    "learn": 9088,
+    "health": 10801,
+    "investigate": 11454,
+    "ios-clean": 8706,
+    "ios-design-review": 8887,
+    "ios-fix": 8659,
+    "ios-qa": 11399,
+    "ios-sync": 8830,
+    "land-and-deploy": 16075,
+    "landing-report": 9512,
+    "learn": 9182,
     "make-pdf": 4957,
-    "office-hours": 18890,
+    "office-hours": 18984,
     "open-gstack-browser": 4504,
     "openclaw/skills/gstack-openclaw-ceo-review": 2764,
     "openclaw/skills/gstack-openclaw-investigate": 1429,
     "openclaw/skills/gstack-openclaw-office-hours": 4433,
     "openclaw/skills/gstack-openclaw-retro": 2542,
-    "pair-agent": 11513,
-    "plan-ceo-review": 19604,
-    "plan-design-review": 19045,
-    "plan-devex-review": 16886,
-    "plan-eng-review": 13825,
-    "plan-tune": 14662,
-    "qa": 13401,
-    "qa-only": 13175,
-    "retro": 18865,
-    "review": 15119,
+    "pair-agent": 11607,
+    "plan-ceo-review": 19698,
+    "plan-design-review": 19139,
+    "plan-devex-review": 16980,
+    "plan-eng-review": 13920,
+    "plan-tune": 14756,
+    "qa": 13495,
+    "qa-only": 13269,
+    "retro": 18959,
+    "review": 15213,
     "scrape": 3939,
     "setup-browser-cookies": 3194,
-    "setup-deploy": 10851,
-    "setup-gbrain": 15456,
-    "ship": 19956,
-    "skillify": 12094,
-    "spec": 14589,
-    "sync-gbrain": 13876,
+    "setup-deploy": 10945,
+    "setup-gbrain": 15550,
+    "ship": 20050,
+    "skillify": 12188,
+    "spec": 14684,
+    "sync-gbrain": 13970,
     "unfreeze": 393
   }
 }