fix: adversarial round — the P0 finalize fail-safe and 12 hardened findings

Three adversarial passes (Claude fresh-context, Codex chaos, Codex structured
with P1 gate) on the full wave diff. Multi-source findings, all fixed:

- P0: finalize_queue is now explicit-delete-only — a record is unlinked ONLY
  when classification proves it staged or dropped; a classifier crash, a
  missing class file, or a malformed pulled .brain-privacy-map.json (which
  previously nuked the whole snapshotted queue, remotely triggerable) now
  retains everything, warns, and re-drains next run. load_privacy_map treats
  corrupt maps as retain-all, never as empty.
- next-version cannot silently drop a live claim: unreadable advertised refs
  get a targeted --depth=1 fetch + retry; still-unreadable claims surface as
  UNKNOWN warnings instead of duplicate-version silence.
- session-update lock: ownership-checked EXIT trap (a TTL-reclaimed holder
  can no longer delete the new holder's lock) + a 5-min background heartbeat
  so a legitimately-slow pull/setup is never reclaimed while alive.
- ensure-event collapses ALL same-(event,source) duplicates to one canonical
  entry; unique per-process tmp path; setup call sites surface (not swallow)
  the hardened refusals.
- memory-ingest: --limit counts only policy-permitted pages (denied records
  no longer starve permitted ones); --probe applies the same policy filter as
  --bulk (skipped_policy_* fields on the report).
- version-bump repair accepts a genuine literal 0.0.0.0 VERSION file.
- slug heal restricted to the stray-.git shape — package.json-anchored
  wrapper roots keep their legit sticky identity (#2212 preserved).
- brain-sync: idle fast path sees leftover .migrating records; unparseable
  spool records quarantine instead of warning forever; migration comment
  stops overclaiming the transition-window race.
- CDP throttling justifications document override persistence (callers own
  restoration), pinned in the allowlist test.

Deferred with record: deny retroactivity for already-ingested pages (P2 TODO,
same semantics as the code-import gate); legacy-migration tail race
(transition-window, requires pre-spool writers).

288 pass / 0 fail across the 10 touched suites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-version-bump

@@ -463,13 +463,25 @@ function cmdRepair(args: string[], cwd: string): void {
   const current = readVersionFile(versionPath, versionRel);
   // Guard against readVersionFile folding "file exists but is empty / unparsable"
   // into DEFAULT ("0.0.0.0") — same data-corruption pathway as file-missing (#2600).
-  // A fabricated version must never propagate into package.json.
+  // A fabricated version must never propagate into package.json. But DEFAULT is
+  // ambiguous: a VERSION file that GENUINELY reads "0.0.0.0" (a brand-new repo)
+  // is a legitimate version, not the sentinel. Disambiguate on the raw bytes:
+  // if the trimmed file content itself matches the version shape, proceed with
+  // the repair; reject only when the raw content is empty or unparseable.
   if (current === DEFAULT) {
-    fail(
-      `VERSION file at ${versionRel} is empty or contains no parsable version. ` +
-        "Cannot repair package.json with a fabricated version.",
-      2,
-    );
+    let rawTrimmed = "";
+    try {
+      rawTrimmed = readFileSync(versionPath, "utf-8").trim();
+    } catch {
+      rawTrimmed = "";
+    }
+    if (!VERSION_RE.test(rawTrimmed)) {
+      fail(
+        `VERSION file at ${versionRel} is empty or contains no parsable version. ` +
+          "Cannot repair package.json with a fabricated version.",
+        2,
+      );
+    }
   }
   if (!VERSION_RE.test(current)) {
     fail(