fix(commands): stop assuming shell state survives between blocks

Dogfooding `plan` + `implement` against a throwaway config surfaced one root
defect with many arms: the command templates treat consecutive fenced blocks as
one shell. They are not. Every ```bash fence runs as its own Bash call in its own
process, so a variable set in one block is empty in the next, and `$$` is a
different PID (measured: 21710 vs 22109).

The planner agent confirmed the sharpest arm at runtime, reporting that
`Mode: $RAW_FLAG` "arrived literally unsubstituted" — `--raw` was documented in
three command files while being functionally dead. A machine sweep found the same
root in 20 places across 9 files, well past the two the written fasit predicted:

  - `$RAW_FLAG` read from non-shell agent prompts (analyze, plan, implement)
  - `$TMPFILE` read across blocks (tokens, manifest, whats-active,
    plugin-health) — each command could not read the file it had just written
  - `$GLOBAL_FLAG` across blocks (fix)
  - `$TODAY` never assigned in any block (campaign), passing
    `--reference-date ""` to a write CLI in six places
  - three `$$` temp paths handed to the Read tool (fix), which expands neither

All now follow the hardened drift.md pattern: a fixed literal path, or a
re-derivation inside each block that needs it.

Also fixed, all confirmed against ground truth rather than inferred:

  - `implement` printed a rollback ID it never captured (the timestamp lived only
    inside a command substitution) — the one message a user reads after a bad run
  - `plan` reported "No analysis results found" for valid sessions, because Read
    was pointed at a glob it cannot expand; now uses Glob and verifies the
    analysis report exists before spawning the agent
  - five phase commands wrote state.yaml with two of four required fields; since
    the agent writes all four, a follow-up write silently deleted the rest
  - `implement` promised rollback deletes created files; rollback deliberately
    leaves them (M-BUG-26 still open) — the doc, not the engine, was wrong
  - `implement` claimed a score delta with no pre-change measurement
  - `verifier-agent` was told to write a report it has no tool to write
  - dead `Task` tool name in always-loaded rule context; planner-agent template
    demonstrated the inline file content its own line 110 forbids

The sweeps land as tests/commands/command-shell-state-shape.test.mjs, verified
red before the fix and proven able to fail by reintroducing the defect. Two
existing tests asserted the old bash-block mechanism rather than the intent and
were updated. Suite 1449/0; frozen v5.0.0 snapshots and all scanner code
untouched.

Not fixed, deliberately: neither command scope-gates its actions to the audit
target. The generated plan included an edit to a real file under ~/.claude,
outside the throwaway target, because the skill/agent scanners are machine-wide.
That is a design change, not a side fix.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0195udHgCcFegzm7ecKku2Yc

tests/commands/group-b-shape.test.mjs

@@ -68,13 +68,33 @@ async function readCommand(name) {
   return await readFile(resolve(COMMANDS_DIR, name), 'utf-8');
 }
 
-test('Group B: every file contains a Bash invocation block', async () => {
+// Agent-driven commands invoke no scanner, so they have no bash block to
+// assert. analyze.md's only bash block used to be a `RAW_FLAG=` assignment
+// referenced from the agent prompt below it — a prompt is not a shell, so the
+// agent received the literal string `$RAW_FLAG` (session #49). Removing that
+// block is the fix; requiring one here would re-assert the defect.
+const AGENT_DRIVEN = new Set(['analyze.md']);
+
+test('Group B: every scanner-invoking file contains a Bash invocation block', async () => {
   for (const name of GROUP_B_FILES) {
+    if (AGENT_DRIVEN.has(name)) continue;
     const content = await readCommand(name);
     assert.match(content, BASH_BLOCK_REGEX, `${name} missing bash block`);
   }
 });
 
+test('Group B: agent-driven files spawn an Agent instead of a scanner', async () => {
+  for (const name of AGENT_DRIVEN) {
+    const content = await readCommand(name);
+    assert.match(content, /Agent\(subagent_type:/, `${name} should spawn an Agent`);
+    assert.doesNotMatch(
+      content,
+      /RAW_FLAG=/,
+      `${name} must not assign a shell variable it then references from an agent prompt`,
+    );
+  }
+});
+
 test('Group B: every file references the Read tool', async () => {
   for (const name of GROUP_B_FILES) {
     const content = await readCommand(name);