lang: act on the adversarial review -- five defects, two of them mine

An adversarial reviewer in an isolated checkout at fbe4746 returned 12 confirmed findings. Five needed code; the rest are corrected comments, or reported and deliberately not fixed here.

TWO DEFECTS THIS BRANCH INTRODUCED, ONE ROOT.

allow-failure: excused a gate-born errored node, and I had just made that status reachable. Consequences, both measured: a group whose every node was born errored by an undecidable gate rolled up "passed" -- green badge, group-terminal? true, nothing ran; and predecessor-verdict declined to gate the dependents of the very node kiln refused to decide, so everything downstream was promoted to pending. Permissive in both directions at once, which is the shape this whole evaluator exists to remove.

Fixed at the source rather than in each consumer: allow-failure: is a promise about the JOB'S WORK failing, not about kiln being unable to work out whether the job should run, and an author cannot have meant it that way because they believe their clause is decidable. An undecidable gate now clears the flag in the stored plan form.

THE REST.

• A node born TERMINAL was never stamped finished_at. db-create-node-run! writes a status column and nothing else, and db-update-run-status! is the only thing in the tree that stamps the timestamp, so writing the terminal status at creation walked past it. That falsified queue.sgl:57-62 by name and rendered a gated-off node on a different time basis from its cascade-skipped siblings.

• A matrix dimension could shadow $ref/$sha/$trigger, and the two resolvers disagreed about precedence: the gate read the binding, the ${...} interpolation beside it read the run context. when: (branch? $ref) under matrix: #{ ref: ... } silently answered #f and skipped the job. Now refused at lint AND the evaluator's precedence is aligned with the interpolator's, because plans are stored and replayed and the linter holding is not a defence for a form already in the database.

  Scoped to the three names something actually resolves, not all of
  run-context-vars: refusing the whole list broke run-lang-checks.sgl's
  "dimensions named after kiln's own keys still expand", which names a
  dimension `steps` on purpose because over-refusal is a known risk on
  this surface. That control did its job.

• compile-node-script's optional 4th argument was unvalidated: a wrong value raised "dict-ref: expected dict" from record internals if the node happened to have a gated step, and was accepted in silence if it did not; a 5th was ignored. Validated at the boundary now.

• emit-step's refusal rendered a string head "shell", a keyword head shell: and the supported symbol shell identically, and a number head as the empty string. It writes the head now. Also removed an unreachable else arm that looked like a live backstop.

Comments corrected rather than code: derive-fork's soundness argument holds on the webhook path and NOT on /api/plan-runs, which reads trigger and trusted as independent caller-supplied fields (route is behind with-auth, so caller-integrity rather than anonymous); the gated? accumulator is an optimisation with no observable behaviour, which the reviewer proved by removing it and watching 206 checks stay green; advance-group!'s docstring claimed a skipped-yet-allow-failure promotion that predecessor-verdict has never implemented.

Reported, NOT fixed here: a gated-off node posts no forge commit status, re-opening the hole runner.sgl:626-633 documents -- it needs report-commit-status!, whose signature is being changed by other work (t-4af08d).

test/run-when-checks.sgl: 95 -> 119 checks. Twelve raises? arms had no message assertion and would have passed on any raise at all, including one from a typo in their own fixture; they now name a substring only the intended refusal produces. Two fork? arms did not test what their names claimed and were rewritten. Sabotage re-run at ten legs, every plant hash-verified, every sabotaged tree confirmed to still compile, every leg red.

Corrects an overstatement in fbe4746's message: jobs/sigil-release.kiln does not compile at that SHA for SIX reasons (worker image:, a packaged action head, secrets:, use:), not only the secrets: refusal, so the publish job was not reachable to run on every push. The ordering argument is unaffected -- when: being permissive is a defect however few files currently reach it, and any gated publish job would run ungated the moment secret injection lands.