backlog: record the adversarial audits of #1064, #1086 and #1097 -- all three stay open

[wshallwshall]

Records the adversarial audit findings against BACKLOG #1064, #1086 and #1097. All three stay
OPEN. All three attempted fixes remain local-only and anchored; none is pushed, and none should land.

#1086 -- the attempt would have introduced a new bypass and shipped a test defending it

Its premise -- "a message flag's quoted span is DATA, not a command" -- is false for the two spellings
that matter. Confirmed by execution:

"a $(1+1) b"   -> a 2 b          @"..."@ -> a 2 b        <- TEMPLATES, substituted
'a $(1+1) b'   -> a $(1+1) b     @'...'@ -> a $(1+1) b   <- inert

Six verdicts moved DENY to ALLOW carrying live $(...) payloads, and the commit added the executable
spelling to the must-ALLOW parametrize -- so the bypass acquires a test defending it, on a
machine-global file governing ~57 worktrees. A control weakened, with a new test pinning the weakening
as intended behaviour.

Where the mistake actually sits, found by reading the diff rather than the audit summary. The lane
was not careless about the obvious hazard -- its own comment says "key on the consumer, never the
delimiter -- the identical here-string after pwsh -Command IS code that runs, so blanking by shape
would re-open the interpreter route-around." It reasoned correctly about what git does with the
argument. It never reasoned about what the shell does before git is invoked. "The premise is false"
was true but did not locate the error.

The corrected scope is therefore narrow: blank only the spans PowerShell cannot substitute --
'...' and @'...'@. And it costs nothing legitimate, because this repo's own documented convention
for multi-line commit messages is the single-quoted here-string -- the inert form is the house form, so
the original complaint is fully served by covering the literal spans alone.

#1097 -- sound, but it generalised one dimension of several

The generating rule that replaced the hand-typed prefix list is correct, its red-first is genuine in
both directions, and its bounded-ness mutant works. The gap is that the sigil stayed a hand-typed
two-member class [-/] inside a fix whose whole purpose was to stop hand-typing enumerations. Measured:
pwsh --command, --Com and --c all execute.

Its proposed banner claimed "the missing spellings were every prefix from -C to -Command" -- a false
completeness claim (SDS-3.6), which a compensating control then rests on (SDS-3.7). The rebuild builds
on this fix rather than replacing it, audits the remaining dimensions rather than assuming two is
all of them, and drops the completeness claim.

#1064 -- deliberately not rebuilt yet

One of its four open bypasses is a regression the attempt itself introduced, and any whitespace in
the repo path defeats rule 3d entirely, absolute spelling included -- latent here only because this
box's primary path has no space, which breaks the report's own control row. A brief is not trustworthy
while its own control does not hold, so it waits rather than sending a lane at a moving target.

The batch is a good outcome, not a wasted one

Three lanes, zero landable commits. Two of the three would have shipped a bypass into the worktree gate
and one would have shipped a test defending it. Every lane's process was strong -- real mutants,
byte-identical restores, disclosed residual gaps, no deleted coverage, no false denies. Process cannot
check a premise: red-first proves a change has the effect it claims, never that the effect is
desirable. That is the argument for an adversarial reader as a separate stage rather than a stricter
checklist on the same one.

Ledger-only, +28 lines. Verified: all 252 items still declare exactly one status banner (the
invariant backlog_status_check enforces), open = 184, #1064/#1086/#1097 all remain open, merges
clean onto current main.