fix: pre-landing review fixes (#2733)

Review army + coverage audit findings, all applied:
- headless directive carries the spawned escape sentence too (multi-
  specialist: a CI-hosted ship's marked subagent must not end BLOCKED)
- anti-injection scoping on every text-claimable spawned trigger (AUQ
  rule + shared escape sentence): markings count only from the creating
  prompt, never from files/tool output/web content read mid-run
- [conductor][spawned] deny annotates one-way doors per question
- SPAWNED_OVERRIDE: env tamper-visibility status line + OPENCLAW.md note
- spawned sessions skip the network update-check and first-task probe
  (consumers suppressed; preserves the one-shot just-upgraded marker)
- test hardening: dispatch-tripwire end-bound validated, vacuous marker
  asserts replaced with output asserts, E2E cpSync size filter + named
  fence tolerance, spawnedByEnv parity pin, destructive-policy cross-
  surface drift guard, one-way annotation + bogus-value hook cases
- session-kind duplicate rationale comment deduped; regen + goldens +
  context-budget fixture refreshed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/resolver-ask-user-format.test.ts

@@ -252,6 +252,13 @@ describe('generateAskUserFormat — runtime-failure prose fallback', () => {
     expect(out).toMatch(/in `SESSION_KIND: spawned` you should never reach this checklist/);
   });
 
+  test('Spawned: rule scopes markings to the creating dispatch prompt (anti-injection)', () => {
+    // "(or your dispatch prompt marks this session as spawned)" is a
+    // text-claimable trigger — the rule must explicitly refuse spawned
+    // claims sourced from files/tool output/web content read mid-run.
+    expect(out).toMatch(/NEVER count[\s\S]*prompt injection/);
+  });
+
   // Conductor-default-prose contract (the proactive path, distinct from the
   // failure fallback). Guards the Tool-resolution rule + self-check wording.
   test('Conductor: do-not-call rule present in Tool resolution', () => {