fix: round 7 of the release review of 6.3.0, for 6.3.1

Round 7 (516dffa..45aa9e1, WARN: 12 MAJOR, 0 BLOCKER) and the fence defect
found while writing its review.md. Each fix began with a test that failed on
0f400d3 (v6.3.0); suite 2208 (2206/0/2), 14 tests more.

- Tests-only (operator 2026-10-11): the plan's Files: alone decides, and the
  text says so (red-proof, trekexecute Sub-step B, step-implementer,
  HANDOVER-CONTRACTS). red-proof no longer reads the step's diff, so a change
  already in the tree when the step began no longer counts against it, and a
  plan placed outside .claude/ reads the same. The round-6 test that had the
  diff overrule the plan is rewritten to the new rule.
- The Files: reader keeps a plain file beside a backticked path
  (", Dockerfile", "the CLI entry src/cli.mjs", "and Makefile"). Measured on
  the 520 Files: fields in 182 plans: no field reads differently.
- Red proof reports a command its timeout killed as killed after the timeout,
  not "could not start"; the release check tells a timeout from output past
  its buffer and from another signal. One reading of a stop
  (criteria-runner stoppedBy) for red proof, the criteria runner and the
  release check.
- A trailing `# comment` is dropped in a backticked check too, and in a
  command passed as written, so the words screened are the words run.
- The release check reads a relative --review in --repo.
- The 15-minute timeout is defined once (criteria-runner.mjs).
- The findings check reads each cited file once per validation.
- One isMain helper (lib/util/is-main.mjs) for every CLI: the 31 copies of
  the realpath guard and the 20 modules still on the file:// guard, which
  exited 0 having done nothing under a symlink or a path with a space.
- The Bash guard writes its no-one-to-ask refusal once, on a direct condition.
- The findings check ends a ```json block only at a fence on its own line, so
  three backticks inside a JSON string no longer end it (also in 6.2.0).
- Brief-conformance notes: a test for test-lock green on exit 127 (it
  passed at once; it fails when 127 is read as could-not-run); the prose now
  names the git revision `@~1` as the one leading-@ exception.

Not changed: the example plan's steps 1-2 keep their tests-only warning
(operator decision 2026-10-09; the r5 test records it). Brief note 4 (a
Regression: whose runner is not installed goes to the fix rounds) is a
routing question for the operator.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/stats/cache-analyzer.mjs

@@ -9,6 +9,7 @@
 // Zero npm dependencies. Node stdlib only.
 
 import { readFileSync, existsSync } from 'node:fs';
+import { isMain } from '../util/is-main.mjs';
 
 function usage() {
   return `cache-analyzer.mjs — summarize trekexecute-stats.jsonl
@@ -123,7 +124,7 @@ export function summarizeFile(path) {
   return summarize(text.split('\n'));
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMain(import.meta.url)) {
   const args = process.argv.slice(2);
   const jsonIdx = args.indexOf('--json');
   if (jsonIdx === -1 || !args[jsonIdx + 1]) {

lib/stats/event-emit.mjs

@@ -30,10 +30,10 @@
 // Import direction: event-emit imports stats-append; stats-append must never
 // import event-emit (that would be a cycle).
 
-import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { resolveStatsDir } from './stats-append.mjs';
+import { isMain } from '../util/is-main.mjs';
 
 export const KNOWN_EVENTS = Object.freeze(new Set([
   'brief-approved',
@@ -110,17 +110,7 @@ function parseArgs(argv) {
   return out;
 }
 
-// Run as a CLI? Compared as real paths: `file://${argv[1]}` misses a path with a
-// space (URL-encoded) and a symlink (import.meta.url is the realpath).
-function isMain() {
-  try {
-    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-if (isMain()) {
+if (isMain(import.meta.url)) {
   const args = parseArgs(process.argv.slice(2));
   let result;
   if (!args.event) {

lib/stats/stats-append.mjs

@@ -23,11 +23,11 @@
 //   JSON
 //   → prints {"written":true,"path":...} exit 0 | {"written":false,"reason":...} exit 1
 
-import { appendFileSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
+import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { attributeOrder } from './claimed-order.mjs';
+import { isMain } from '../util/is-main.mjs';
 
 export const STATS_KINDS = Object.freeze([
   'trekbrief', 'trekresearch', 'trekplan', 'trekexecute', 'trekreview', 'trekcontinue',
@@ -68,17 +68,7 @@ export function appendStatsRecord(kind, record, env = process.env, { cwd = proce
   return { written: true, path };
 }
 
-// Run as a CLI? Compared as real paths: `file://${argv[1]}` misses a path with a
-// space (URL-encoded) and a symlink (import.meta.url is the realpath).
-function isMain() {
-  try {
-    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-if (isMain()) {
+if (isMain(import.meta.url)) {
   const kind = process.argv[2];
   let record = null;
   let reason = null;