Fix the four blocking findings from PR #268's review #270

Current scope

Unfret's verdict on PR #268 head 0087ba6 raised four blocking findings. Classes (batch owner, 2026-11-06):

1. v1:233d6c57… verdict-changing: the verifier's setup configure case compares setting lines as an exact singleton, but settingLines now returns every provider's line and the case's preparation removes only Codex's. A sheet with another provider's writer line fails the live gate.
2. v1:857b2c9a… verdict-changing: writers is not in the shared-recipe expansion in .claude/skills/verify-open-pstack/scripts/core.ts, so a PR that changes only features/recipes.ts cannot name writers.
3. v1:35b3cceb… verdict-changing: agy's catalog note (from registry/providers.ts) still names the agent pstack-read-only after the rename to pstack-lane, and still says the lane's tools are removed, which 1.5.2 contradicts.
4. v1:577bc17a… fails-loudly: setup accepts <provider> writer sandbox: full-access for a provider whose adapter declares no full-access writer (dsh, Grok, Claude); the runner refuses it at dispatch.

Acceptance:

• Items 1 to 3 fixed with the smallest change; items 1 and 2 each get the test the finding's scenario needs.
• Item 4 gets no repair: the runner refuses the lane at dispatch, so nothing writes unconfined. It is recorded with its class only.
• Advisories (stale agy command, Muse unavailable-model details, docs/reference.md version) may be fixed in the same diff only if they touch the same lines.

Introduced by: #268