Integrate safe Stop defer boundaries

[BananaAccurate]

Summary

This PR is a stacked Tailtest repair branch on top of the existing prerequisites in PRs #8, #10, #11, and #12. The new Stop-specific commits are:

• cd984ea — honor safe Stop defer boundaries
• 6793f43 — preserve matching Stop fences

Root cause / behavior

The Stop hook needed stricter separation between trusted current-user stop directives and untrusted transcript/repository data. This branch keeps default queue-blocking behavior, preserves queued work across explicit one-turn defer/no-more-tools flows, and only honors defer wording when it is attributable to the latest supported user directive.

The follow-up fix tracks Markdown fence opener marker/length so mixed backtick/tilde fences cannot prematurely expose an embedded /tailtest defer command as executable control text.

Security boundaries

• Treats transcript content as untrusted data unless it is the latest supported user message.
• Ignores defer wording in assistant/tool output, fenced examples, quoted examples, filenames, malformed transcript records, and external transcript paths.
• Bounds transcript reads and contains transcript paths under approved Codex session roots.
• Preserves pending queue state for the next user turn rather than clearing work silently.

Validation

On 6793f43104d9a5fbdefc246cb9990b9de81cfac1:

• Windows python -m pytest -q: first full-suite run exposed a non-reproduced tests/test_mtime_sweep.py::TestGitCleanMtimeChurnSkipped::test_clean_tracked_file_with_new_mtime_is_skipped_when_git_required failure; focused test passed, default-order prefix passed, and full rerun passed with 435 passed in 71.07s.
• Windows python -m ruff check .: passed.
• Windows python -m ruff format --check .: passed, 28 files already formatted.
• Windows git diff --check: passed.
• WSL python3 -m pytest -q && python3 -m ruff check . && python3 -m ruff format --check .: passed with 434 passed, 1 skipped, Ruff check passed, and 28 files already formatted.
• SDD scoped re-review marked the prior Critical mixed-fence finding ADDRESSED with no new Critical/Important breakage.

Remaining limitations

• This is not release completion. Upstream merge, tag, release, released-artifact fresh install, and post-release live canaries remain blocked until maintainers merge the upstream PR stack and release authority is available.
• Status check rollups may remain empty until the CI workflow introduced in the stack exists on upstream main.

Maintainer edits are enabled.