fix(execute): Phase 7 pins the criteria runner to the working tree, like Phase 4.5

/trekreview passed --cwd and trekexecute Phase 7 did not, so the same criterion
could resolve two ways in the two phases (PM checkpoint 2026-09-18, MINOR).

It stopped being cosmetic with the refusal list: --cwd is the boundary a write
is measured against, so leaving it unset silently moves that boundary to
whatever the process cwd happens to be. Both phases now resolve

  CRITERIA_CWD="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"

- one form, with a fallback, so a repo-less checkout falls back instead of
passing an empty --cwd. Pinned in tests/lib/doc-consistency.test.mjs.

Red first: the new pin failed on both phases before this change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/lib/doc-consistency.test.mjs

@@ -1857,6 +1857,23 @@ test('D-03: trekexecute Phase 7 runs the plan Verification on the single-session
 // Success Criterion's verification command "exists and passes" — with Read/Glob/Grep. The
 // command now runs the commands and hands over the result; the reviewer stays read-only.
 // Fix the SOURCE.
+// PM checkpoint 2026-09-18, MINOR: /trekreview passed --cwd and Phase 7 did not,
+// so the same criterion could resolve two ways in the two phases. It is no longer
+// cosmetic - --cwd is the boundary the runner's refusal list measures a write
+// against, so an unset one silently moves that boundary to the process cwd.
+test('both phases pin the criteria runner to the working tree with --cwd', () => {
+  const phase7 = (read('commands/trekexecute.md').split('\n## Phase 7 — ')[1] || '').split('\n## ')[0];
+  const phase45 = (read('commands/trekreview.md').split('\n## Phase 4.5 — ')[1] || '').split('\n## ')[0];
+  for (const [label, phase] of [['trekexecute Phase 7', phase7], ['trekreview Phase 4.5', phase45]]) {
+    assert.ok(phase.length > 0, `${label} must still exist`);
+    assert.match(phase, /--cwd "\$CRITERIA_CWD"/, `${label} must pass --cwd, and the same resolved value`);
+    assert.match(
+      phase, /CRITERIA_CWD="\$\(git rev-parse --show-toplevel 2>\/dev\/null \|\| pwd\)"/,
+      `${label} must resolve the working tree with a fallback — an empty --cwd is a moved boundary, not an error`,
+    );
+  }
+});
+
 test('D-04: the conformance reviewer judges a supplied result, and never runs a command', () => {
   const a = read('agents/brief-conformance-reviewer.md');
   assert.ok(