feat(execute)!: hand waves over as session orders, never start Claude Code (green)

Operator decision 27.09.2026: Voyage works the PM way, so nothing in it
starts Claude Code. Work that needs another session becomes an order plus
a starter line the user gives a session they open themselves; Voyage
never starts the session.

/trekexecute's multi-session path (Phase 2.6) now prepares one wave at a
time: worktree per session, then lib/util/session-orders.mjs writes one
order per session (worktree, steps, done-condition, starter) plus
orders/wave.json, and the run stops. Running the same command again reads
each session's progress file (status mode), merges sequentially with
push-before-cleanup as before, and prepares the next wave. Phase 2.5 skips
the destructive pre-flight while a wave is in flight. Phase 7.6 recovery is
handed over the same way. Hard rule 21: never start Claude Code.

Removed with it, because they existed only for launched children: the
ANTHROPIC_API_KEY billing check (and its dry-run line and Hard rule 1
exception), the hooks-fire version precheck, the safety preamble, the
scoped-tool/turn/budget flags, templates/headless-launch-template.md, the
decomposer's launch.sh (now orders.md), /trekplan's "launch", the README
billing and MCP tuning sections, and scripts/q3-cache-prefix-experiment.mjs
(an experiment that spawned the binary; its results stay in docs/).
/trekresearch's deep-research pre-gate no longer runs the binary for its
version; the post-hoc check was already the authoritative guard.

Chose orders + starters over in-session subagents because the order's done
criterion asks for exactly that, and because /trekexecute disallows the
Agent tool on purpose (Hard rule 10); reopening that is a separate change.

Gate: 54 -> 0 hit lines outside EXEMPT. npm test 1250 (1245 pass, 0 fail,
5 skipped: 3 are the retired-reference scan without its local list).
verify.sh 7/0. The fixture run (tests/lib/session-orders.test.mjs) writes
two orders and wave.json for wave 1 and leaves a trap binary untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

commands/trekresearch.md

@@ -245,8 +245,7 @@ Then continue to the next phase inline.
 > deep), so that block no longer holds — a delegated redesign is under
 > evaluation (see `docs/cc-upgrade-2.1.181-decision-matrix.md`, W1/CC-26).
 > Until then, running the phases inline in main context keeps the swarm
-> intact. Use `claude -p` in a separate terminal window for long-running
-> headless work.
+> intact.
 
 ---
 
@@ -331,26 +330,21 @@ changes nothing (SC1). Keep the native-swarm anchors intact ("in parallel",
 
 **engine = deep-research:**
 
-1. **Coarse pre-gate (best-effort, NOT a trust signal).** `Bash: claude --version`;
-   parse the leading `X.Y.Z` (e.g. from `2.1.196 (Claude Code)`) and compare
-   numerically against **both ends** of the supported window
-   `2.1.154 <= version < 2.1.218` — split each on `.` and compare major, then minor,
-   then patch as integers (do NOT string-compare; lexical comparison mis-orders
-   multi-digit patch numbers). If the version is `< 2.1.154` (below the
-   dynamic-workflows floor), OR `>= 2.1.218` (the ceiling: `/deep-research` starts
-   only when the operator invokes it, and the Skill tool refuses a model invocation
-   with `disable-model-invocation` — see step 4's reason token), OR if
-   `disableWorkflows: true` / `CLAUDE_CODE_DISABLE_WORKFLOWS=1` is set, skip to the
-   fallback (step 4). **If `claude` is not on PATH inside the Bash tool (possible
-   under `claude -p`) or the version cannot be parsed, treat the pre-gate as
-   *indeterminate* and proceed to step 2 — do NOT hard-fail.** There is no positive
+1. **Coarse pre-gate (best-effort, NOT a trust signal).** The supported window is
+   `2.1.154 <= version < 2.1.218`: below `2.1.154` there are no dynamic workflows,
+   and from `2.1.218` (the ceiling) `/deep-research` starts only when the operator
+   invokes it, and the Skill tool refuses a model invocation with
+   `disable-model-invocation` — see step 4's reason token. Voyage does not run the
+   Claude Code binary to read its version (it never calls Claude Code), so the
+   version is *indeterminate* here. If `disableWorkflows: true` /
+   `CLAUDE_CODE_DISABLE_WORKFLOWS=1` is set, skip to the fallback (step 4);
+   otherwise proceed to step 2 — do NOT hard-fail. There is no positive
    availability probe (research Dim 4), so a passing pre-gate does not guarantee the
    workflow runs; the post-hoc check (step 3) is the authoritative guard.
 
 2. **Run.** Instruct Claude (in prose, this turn) to run
    `/deep-research <research question>` and request per-claim citations. Note:
-   interactive default/acceptEdits triggers a per-run approval prompt; `claude -p` /
-   SDK / bypass runs immediately.
+   interactive default/acceptEdits triggers a per-run approval prompt.
 
 3. **Post-hoc presence + provenance check (the real guard).** Verify a real, cited
    `/deep-research` report actually landed in context — substantive findings with
@@ -366,8 +360,8 @@ changes nothing (SC1). Keep the native-swarm anchors intact ("in parallel",
    `Engine: deep-research → swarm (fallback: <reason>)` and carry the reason into the
    Phase-8 Present summary and the brief's `## Executive Summary`. Known reason
    tokens: `disable-model-invocation` (CC >= 2.1.218 — the expected reason on any
-   current Claude Code), `version-below-floor`, `workflows-disabled`,
-   `no-cited-report`. **NEVER fabricate
+   current Claude Code), `workflows-disabled`, `no-cited-report` (also what a
+   Claude Code below the `2.1.154` floor produces, since no version is read). **NEVER fabricate
    or synthesize a substitute report** — a structurally-valid-but-invented brief
    passes the structure-only validator and silently poisons `/trekplan`; that is the
    worst outcome of this feature.