#3310 + #3311 · the last two criticals · milestone v10.0.0

Two dead controls

Both authored in good faith, both logging as if they worked, both inert in production. The #3307 theme, again: writes to CC contracts nobody verified against the binary.

#3310  context-gate "blocked" spawns with a PreToolUse envelope
       on a SubagentStart event — CC reads NOTHING of that shape.
       The cap has never fired. Once.

#3311  a full sandbox block: failIfUnavailable, filesystem denies,
       20 blocked egress domains — and the key "enabled" is ABSENT.
       All of it inert. And 0 of 21 permission denies were Read().

#3310 · the fix, and the valve that never opened

Over-limit paths now ADVISE via { continue:true, systemMessage }, a shape CC accepts on every event. CC's own caps (16 concurrent / 1000 per run) govern; the hook's value is telling the model it is over budget, which a dead deny never did.

The escape valve was equally dead: try a cwd below.

test file: context-gate-envelope.test.ts
  against pre-fix code   3 failed | 2 passed   (the DoD red)
  against this change    5 passed

#3311 · what this PR does, and honestly does not

changeeffect
sandbox.enabled: true the authored artifact stops lying about itself
5 × Read() credential denies ~/.ssh, ~/.aws/credentials, ~/.gnupg, ~/.netrc, ~/.npmrc — the gap where nothing blocked a read of an SSH key

Not claimed: activation. CC reads only agent and subagentStatusLine from a plugin's settings.json, so this file is what ork:configure copies into user settings, not something CC consumes directly. Turning the sandbox ON for a machine is an operator step (it changes every Bash call), left deliberately out of this PR and documented on the issue.