fix: close the six defects an independent review found in the trial fixes

Independent read-only review of c56f852..2d29966 (2026-10-08), each defect
reproduced by the reviewer; each new test fails on that code.

- test-lock green ran ANY allowlisted command: `green --cmd "git status"`
  marked a red step green and the stop guard let it stop. The lock now
  stores the step's test command (`lock --cmd`); `green` runs only that
  one (a different --cmd, or a lock without one, exits 2). trekexecute D1
  calls `green` with no command, which also removes the quoting hazard.
- plan-gate --accept-open worked at round 1 and passed the gate; it now
  refuses while rounds are left.
- findings-schema --repo-root swallowed a following flag, or took a root
  that does not exist, and silently skipped the line check: exit 2.
- brief-review-stamp hashed only the body, so a changed `framing` or
  `research_topics` stayed "current"; it now covers the reviewed
  frontmatter too (only the post-review stamps are left out).
- red-proof red_kind read an assertion message naming SyntaxError as a
  load error; the signatures are now specific.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/review/findings-schema.mjs

@@ -190,6 +190,10 @@ export function validateReviewerOutput(rawText, opts = {}) {
 
 // ---- CLI shim ----------------------------------------------------------------
 
+function isDir(p) {
+  try { return statSync(p).isDirectory(); } catch { return false; }
+}
+
 function isMain() {
   try {
     return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
@@ -205,7 +209,10 @@ if (isMain()) {
   // Without the flag nothing is skipped (rootIdx + 1 would be 0: the file).
   const skipIdx = rootIdx >= 0 ? rootIdx + 1 : -1;
   const filePath = args.find((a, i) => !a.startsWith('--') && i !== skipIdx);
-  if (!filePath || (rootIdx >= 0 && !repoRoot)) {
+  // A missing value, a flag in its place, or a root that is not a directory
+  // would switch the line check off without a word: a usage error instead.
+  const badRoot = rootIdx >= 0 && (!repoRoot || repoRoot.startsWith('--') || !isDir(repoRoot));
+  if (!filePath || badRoot) {
     process.stderr.write('Usage: findings-schema.mjs [--json] [--repo-root <dir>] <reviewer-output.txt|.md>\n');
     process.exit(2);
   }