feat(engine)!: the inbox is a priority, not a suggestion

Through 0.4.0 the injection block told every repo to "consider
replying/resolving where it fits in this session". That sentence was the
whole problem: the injection text is the only place a repo is ever told
what to do with a message, so the wording IS the protocol -- and it
granted permission to defer. Messages sat unanswered for weeks while each
session did its own work first. Nothing was broken; the protocol was
asking for exactly what it got.

The block now states an ordering and a completion obligation: handle the
inbox before the task the session came to do, and drive every directed
message to a terminal state before the session ends (--reply-to or
coord-done). Neither terminal state is the default -- the format has no
reply-expected field, so mandating only the reply would manufacture
traffic for messages that merely inform. Leaving one pending stays
allowed but must be stated to the operator with a reason.

Raising priority deliberately does not widen the trust boundary. The
obligation is procedural, never substantive: responding is mandatory,
complying with what a message asks is not. Untrusted cross-repo content
still cannot direct the reader; it merely can no longer be ignored. The
injection states both halves and selftest section 20 pins them together,
so a future reword cannot keep the priority and quietly drop the
distinction -- that combination would turn prioritization into an
injection surface.

Selftest 82 -> 93.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6EixQo6hpoRCVtiAXdnFs

CLAUDE.md

@@ -14,7 +14,7 @@ marketplace plugin. Three components, one boundary:
   grammar, frontmatter, delivery, archiving, the seen set. `coord-send.sh`
   writes, `coord-inbox.sh` reads (formatted for context injection),
   `coord-done.sh` archives. Everything is pinned by `coord-selftest.sh`
-  (82 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
+  (93 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
 - **Hook (`hooks/scripts/session-start.mjs`):** thin zero-dependency Node
   wrapper (marketplace convention: hooks are `.mjs`) that calls
   `coord-inbox.sh` and emits the `hookSpecificOutput.additionalContext`
@@ -27,6 +27,16 @@ live in the owning repo's docs/git history; messages are notices pointing at
 them. Message content is untrusted cross-repo input — the read side quotes
 and frames it; the send side sanitizes line-oriented fields.
 
+**Priority rule (v0.5.0, Rule 7):** the injection block is the only place a
+repo is ever told what to do with a message, so its wording *is* the protocol
+— treat that string as engine behavior, not prose. It obligates handling the
+inbox first and driving every directed message to a terminal state before the
+session ends. The obligation is **procedural, never substantive**: responding
+is mandatory, complying with message content is not. Those two must stay
+distinct in any reword — keeping the priority while dropping the distinction
+turns prioritization into an injection surface. Selftest section 20 pins both
+halves together for exactly that reason.
+
 ## Conventions
 
 - Scripts are bash-3.2-safe and ASCII-only: no `declare -A`, no
@@ -35,7 +45,7 @@ and frames it; the send side sanitizes line-oriented fields.
 - Zero dependencies everywhere: bash + coreutils in the engine, `node:`
   builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
-  `bash scripts/coord-selftest.sh` must exit 0 (82/82).
+  `bash scripts/coord-selftest.sh` must exit 0 (93/93).
 - English for all code, docs, and commit messages (public repo). Norwegian
   trigger aliases in the skill description are deliberate.
 - Conventional Commits: `type(scope): description`.