feat(loop-drill): fire drills that prove guardrails actually fire - #600

docs/failure-modes.md names ten ways loops fail. loop-audit scores whether the
mechanical counterparts are *present*. Nothing checked whether they fire.

The sharpest case is the verifier. loop-audit awards its joint-largest signal
(14 points) for one, and gates L3 on it, via a filename check:

    if (base.includes('verifier') || base === 'loop-verifier')   // auditor.ts:181

An empty file passes. On a scratch repo, `touch .claude/agents/verifier.md`
moves the score 34 (L0) -> 55 (L1). docs/failure-modes.md calls the resulting
failure Verifier Theater and rates it S2; docs/primitives.md calls maker/checker
"the single most important structural pattern for reliable loops". The scorer
meant to certify that pattern was performing it.

loop-drill injects a known fault and asserts the guardrail responds. Each drill
is tagged with the failure mode it exercises, so the report reads as coverage of
docs/failure-modes.md rather than a list of anonymous assertions.

Every guardrail is drilled in both directions, because only one is easy:
sensitivity (the fault is caught) and specificity (benign input is not). A
denylist of ["**"] catches every seeded fault and still fails, because it blocks
an ordinary docs change too.

The verifier canary borrows mutation testing: apply a mechanical,
behaviour-changing edit to real source and see whether the verifier notices.
Deterministic and model-free, so it costs only what the verifier costs.

Three properties make the score trustworthy:
  - each run is an ephemeral git worktree, removed even on throw
  - a second control runs in a clean worktree; without it a missing
    node_modules fails every mutant for the wrong reason and a broken setup
    reports a perfect score, so mutants are skipped rather than scored
  - a verifier that rejects a clean tree bails before mutants run, so
    reject-everything cannot report 100%

Operators are limited to edits that change behaviour in any C-family language
and read as bugs. `<` -> `>` and `+` -> `-` are excluded: they break TS generics
and string concatenation, and would make a correct verifier look broken.

The gate and breaker drills are offline and deterministic -- no agent, no
tokens -- so the tool is useful before anyone wires up a verifier.

CI runs it against this repo, tolerating exit 1 (a skipped drill) and failing on
exit 2. The guard is an explicit if rather than `cmd || [ $? -eq 1 ]`, because
under set -e a failing command on the right of || does not exit the shell --
that shorter form silently passed an exit-2 drill when first written.

…ary spawn

Review feedback from @cobusgreyling on cobusgreyling#600.

1. test/drill.test.mjs: the unreachable-threshold test was a passing no-op.

   Its name, comment, values and assertion disagreed, and no config could make
   it fail. Chasing that down surfaced a real bug behind it: the breaker drills
   asserted only `decision.escalate`, not *which* rule fired. Escalating for
   another reason leaves the rule under test unproven -- the same standard the
   gate drills already applied via `trigger !== 'denylist'`.

   breaker.stagnation, breaker.no-progress and breaker.token-budget now assert
   their own trigger.

   That exposed breaker.no-progress passing for the wrong reason. It built its
   ledger from errors differing only by a number ("module 1 not found", "module
   2 not found"), and errorSignature() collapses every number to '#', so all
   five normalized to one signature and tripped *stagnation*. The no-progress
   rule was never exercised. It now uses errors that stay distinct after
   normalization.

   The no-op is replaced by tests that fail when the assertion is weakened,
   verified by reverting each trigger check in turn:
     - similarityThreshold as a percentage (95 instead of 0.95) -> identical
       errors never match, the breaker never fires, stagnation unproven
     - noProgressThreshold 1 -> the breaker escalates via no-progress, so
       stagnation is unproven even though the loop did stop
     - maxIterations 2 -> escalates via max-iterations, same conclusion
     - similarityThreshold 0 -> every error counts as the same error, so
       stagnation swallows the no-progress drill

   breaker.token-budget has no wrong-trigger test: its ledger is one successful
   attempt, so no other trigger is reachable. Noted in the test file rather than
   faked.

2. src/canary.ts: promisify(execFile) was called with an options object in the
   `args` position behind an `as never` cast. It worked only because Node
   detects a non-array second argument, and the cast hid the real signature.

   Caller-supplied strings (--verifier-cmd, --setup) now go through
   promisify(exec), the shell form, which is what those flags mean. git keeps
   execFile with an argv array and no shell, so repo paths are never re-parsed
   by a shell. No casts remain.

Canary re-verified end to end after the spawn change: 100% mutation score
against loop-gate's real suite, exit 2 for a rubber-stamp verifier, and timeout
handling still reports "timed out" rather than a spawn error. 57 tests pass.