fix(preflight): host-PATH gate handles path-like binaries (./gradlew) + review cleanups

[tigers1997]

What

Rolls up the three non-blocking advisories the AI reviewer left on the now-merged split dogfood PRs (#88 F1, #89 F2). One logical change: post-merge review cleanups for the stack-reality work. No new feature.

Changes

1. ./gradlew false-positive (real, narrow). check_stack_reality's container-note gate used shutil.which(b), which always returns None for a path-like binary like ./gradlew (a project-local wrapper, never on PATH). A Gradle-wrapper project with a Dockerfile/compose and no root build.gradle therefore got a spurious "toolchain lives in the container" note. The gate now file-checks path-like binaries ((target_dir / b).exists()) and only consults shutil.which for bare names.
2. Redundant import. shutil is imported at module top; the inline import shutil in check_stack_reality is removed.
3. Test + doc accuracy. test/retrofit-hooks/test-sessionstart-matcher-migration.sh case 2 now asserts the marker-clear migrates out of a user's mixed matcherless group (exactly once, under startup|clear) — the surgical behavior the shipped placement-set migration actually has — rather than only checking the user hook survives. The F1 CHANGELOG bullet's stale "subset / left untouched" description (written against my first migration attempt) is corrected to the shipped placement-set pre-pass. New ./gradlew case in test/cc-manifest/test-stack-reality-preflight.sh.

Verification

configure.py --check clean; 105/105 fixtures; dry-run repro of [ STACK WARNINGS ] unaffected for the normal pnpm path (positive=1, negative=0). No behavior change for non-path stacks.

Scope

fix-only cleanup; no tested_up_to / CC_VERSION bump.

🤖 Generated with Claude Code

[claude]

VERDICT: PASS

PR adds three post-merge advisory cleanups from the same review round (#88/#89): (1) fixes a false-positive container note for path-like binaries like ./gradlew by file-checking rather than consulting shutil.which; (2) removes a redundant inline import shutil (module-level import at line 22 covers it); (3) tightens the session-start matcher-migration test to assert the marker-clear actually migrates out of the matcherless group.

Reviewed all four changed files. The _off_host closure is correct: pathlib normalises target_dir / "./gradlew" to target_dir/gradlew, which is exactly the file the test touches. The shutil removal is safe. The new test assertions accurately model the per-command migration already shipped in #88. CHANGELOG ## Unreleased entry is present and accurate. No license, schema, or scope issues.