fix(execute): the Phase 8 payload goes on stdin; /trekreview findings closed

/trekreview of 5680591..84a0621 (verdict WARN: 0 BLOCKER, 3 MAJOR, 1 MINOR,
1 MAJOR suppressed as unverified for length only). All closed red -> green:

- Suppressed MAJOR 1d0171a7 (verified live): Phase 8 spliced {plan-path}
  into a single-quoted --payload. A lone quote broke the shell parse (event
  lost, no written:false to report); a quoted pair ran a command
  substitution and still reported written:true. event-emit now reads
  `--payload -` from stdin and the three Phase 8 blocks pass the payload
  through a quoted heredoc. Checked under bash and zsh.
- 570ba19b: the SC5 set-step extractor read line by line and never saw the
  wrapped Step 0 sentinel (`blocked`); it now matches across the break and
  the test asserts `blocked` is read.
- c69a865a: the Phase 9 line_ref in jsonl-schemas.md was 9 lines off. Both
  trekexecute rows are now pinned to the exact span by a test.
- 0004fa23 (MINOR): the gates_mode_flag_override block says what to do on
  written:false (print the reason, continue).
- emit() docstring no longer says failures are swallowed silently.
- 7ffaede5: chosen to KEEP the prose-only legacy `passed` tolerance, because
  a public-plugin run started under the 6.1.0 prose would otherwise re-run
  every finished step on resume; recorded as an accepted deviation in the
  (local-only) brief. No code change.

Suite 1400 (1398/0/2), was 1393.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/stats/event-emit.mjs

@@ -22,6 +22,7 @@
 //
 // CLI shim:
 //   node lib/stats/event-emit.mjs --event brief-approved --payload '{...}'
+//   node lib/stats/event-emit.mjs --event main-merge-gate --payload - <<'JSON'   (payload on stdin)
 //   → prints {"written":true,"path":...} exit 0 | {"written":false,"reason":...} exit 1
 //     (usage error, payload-not-json and a failed write alike). The command prose
 //     prints the reason and continues.
@@ -29,7 +30,7 @@
 // Import direction: event-emit imports stats-append; stats-append must never
 // import event-emit (that would be a cycle).
 
-import { appendFileSync, existsSync, mkdirSync, realpathSync } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { resolveStatsDir } from './stats-append.mjs';
@@ -69,8 +70,8 @@ export function buildRecord(event, payload = {}, now = new Date()) {
 }
 
 /**
- * Emit an event. Never throws — stat failures are swallowed silently
- * because lifecycle telemetry must not block the user's workflow.
+ * Emit an event. Never throws — a failed write is returned as {written:false,
+ * reason} because lifecycle telemetry must not block the user's workflow.
  *
  * @returns {{ written: boolean, path: string | null, reason?: string }}
  */
@@ -128,7 +129,8 @@ if (isMain()) {
     let payload = {};
     let bad = false;
     if (args.payload) {
-      try { payload = JSON.parse(args.payload); } catch { bad = true; }
+      // `-` = read it from stdin: a quoted heredoc passes it with nothing expanded.
+      try { payload = JSON.parse(args.payload === '-' ? readFileSync(0, 'utf8') : args.payload); } catch { bad = true; }
     }
     result = bad ? { written: false, path: null, reason: 'payload-not-json' } : emit(args.event, payload);
   }