fix(commands): stop writing files no later step can read, and payloads nobody asked for

Dogfooding the four read commands (posture, tokens, manifest, whats-active)
surfaced four defect classes, all in the seam between what a command template
promises and what the scanner behind it actually does.

M-BUG-40, fifth arm: posture wrote four temp files it could never read back.
#49 closed the $$/cross-block class in four commands, but posture survived it —
and so did the guard written to prevent exactly this. The guard compared each
$$ path to the block that created it, so a path written once and then read via
prose had no second occurrence to flag. Measured live: written from PID 21614,
read attempted from PID 23772. The invariant is now blanket (no $$ in any temp
path), which also caught fix.md and feature-gap.md.

M-BUG-43: 6 of 7 scanners write their payload to stdout when --raw/--json is
set even when --output-file was given, and the templates redirected only
stderr. Measured: posture 255 182 B, whats-active 35 922 B, drift 28 316 B,
manifest 23 825 B, tokens 8 768 B. fix and feature-gap never read the file they
wrote, so both recovered one letter grade from a quarter-megabyte dump.

tokens swallowed --json and --with-telemetry-recipe: documented, never
threaded, so --json returned the humanized payload where the docs promise
byte-stable v5.0.0 output.

M-BUG-42: manifest's render contract asked for {load}; the payload carries
loadPattern, so the Load column rendered blank for all 96 rows.

Four new tests (1449 -> 1453), each verified red before the fix. The
render-contract test checks {field} names against a live payload from a
fixture, since a hardcoded key list would drift. Frozen v5.0.0 snapshots
untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VGCk9o27eWo9uXLjkZTXEq

tests/commands/command-shell-state-shape.test.mjs

@@ -151,6 +151,35 @@ test('Shell state: no $$ temp path is referenced outside the block that created
   assert.deepEqual(violations, [], `Unresolvable $$ temp paths:\n${violations.join('\n')}`);
 });
 
+test('Shell state: no $$ appears in any temp path at all', async () => {
+  // Session #50 closed a blind spot in the test above: it only flags a `$$`
+  // path that is *referenced twice*, because it compares each occurrence to
+  // the block that created it. A path written once and then read via prose
+  // ("Read the JSON output file using the Read tool") has no second
+  // occurrence — so posture.md sat green through #49 while being unreadable
+  // by construction: the PID is never printed, so no later step can name the
+  // file. Measured live: written by PID 21614, read attempted from PID 23772.
+  //
+  // The invariant is therefore blanket, not relational: a command template
+  // must not put `$$` in a temp path at all. The hardened pattern from
+  // drift.md — one fixed literal path, repeated literally — is the only
+  // shape that survives the fence boundary.
+  const violations = [];
+  for (const name of await commandFiles()) {
+    const content = await readFile(resolve(COMMANDS_DIR, name), 'utf-8');
+    content.split('\n').forEach((raw, i) => {
+      const re = /(\/tmp\/[A-Za-z0-9._-]*\$\$[A-Za-z0-9._-]*)/g;
+      let m;
+      while ((m = re.exec(stripComment(raw))) !== null) {
+        violations.push(
+          `${name}:${i + 1} ${m[1]} — $$ differs per Bash call; no later step can name this file`,
+        );
+      }
+    });
+  }
+  assert.deepEqual(violations, [], `Unresolvable $$ temp paths:\n${violations.join('\n')}`);
+});
+
 test('Read tool: never asked to expand a glob', async () => {
   const violations = [];
   for (const name of await commandFiles()) {