fix(ci): unbreak the pre-push gate — strict-mode leak and apm-owned settings drift

Two pre-existing failures, both red at HEAD before ADR-0020 work began,
both invisible in an ordinary local run.

RUN_TESTS_STRICT leaked from the environment into test-run-tests.sh's
fixture children. The meta-test is itself a suite the runner discovers,
so under the gate's own invocation the variable propagated outer runner
-> batch_run -> the fixture's copy of run-tests.sh, flipping it strict.
Case 10c (a deliberate control asserting a skip is tolerated WITHOUT
strict) then failed. Six further cases were silently running strict too
and asserting against the wrong stream — case 9 was matching the stderr
strict block rather than the stdout skip list it was written to check.
run_fake now spawns via 'env -u RUN_TESTS_STRICT', so fixture strictness
is a property of the case, never of how the file was launched. No
assertion weakened; run-tests.sh itself is untouched.

pretty-format-json --autofix was re-sorting apm's output on the way into
every commit. .claude/settings.json is apm-owned (ADR-0018/0019) and its
exclude list named fifteen generated manifests but not this file, so
since 2e395a4 it has been committed in a key order apm would never write
— permanent drift on a file with an empty git diff. Content was always
byte-identical; only JSON key order differed. The exclude ships in the
same commit as the corrected file because otherwise the hook re-breaks
it during staging.

apm.lock.yaml: generated_at churn, plus lint's exec_status corrected from
'deployed' to 'gated_pending_approval' — executables.allow grants only
kyberforge#1.5.0, so lint's hooks/bin are genuinely gated.

New coverage: an ambient RUN_TESTS_STRICT must not reach a fixture that
did not ask for it, and under --strict the skip report goes to stderr
only with the stdout list suppressed. Neither was pinned.

.pre-commit-config.yaml

@@ -37,7 +37,20 @@ repos:
         # would not. All fifteen real files (3 root marketplace manifests, 2 per
         # plugin x 6 plugins) match; anything else is hand-authored and gets
         # formatted.
-        exclude: '^(\.claude-plugin/marketplace\.json|\.agents/plugins/marketplace\.json|\.github/plugin/marketplace\.json|plugins/[^/]+/\.claude-plugin/plugin\.json|plugins/[^/]+/\.github/plugin/plugin\.json)$'
+        #
+        # `.claude/settings.json` is the sixteenth, and it is excluded for a
+        # different reason: apm OWNS that file (ADR-0018, ADR-0019), and
+        # `apm audit --ci` replays the install into a scratch tree and diffs
+        # the result byte-for-byte. `pretty-format-json` sorts object keys
+        # unless `--no-sort-keys` is passed, while apm's hook integrator emits
+        # insertion order (`matcher` before `hooks`, `type` before `command`).
+        # Formatting the file therefore rewrites apm's output into a form apm
+        # would never produce, and the `apm-audit-ci` pre-push hook reports it
+        # as permanent drift on a file with no git diff -- exactly what
+        # happened when the SessionStart hook first landed in 2e395a4.
+        # Re-running `apm install` fixes the file; leaving it in scope here
+        # would re-break it on the very commit that carries the fix.
+        exclude: '^(\.claude-plugin/marketplace\.json|\.agents/plugins/marketplace\.json|\.github/plugin/marketplace\.json|plugins/[^/]+/\.claude-plugin/plugin\.json|plugins/[^/]+/\.github/plugin/plugin\.json|\.claude/settings\.json)$'
       - id: check-yaml
         stages: ['pre-commit']
       - id: trailing-whitespace