fix(ci,windows): gate release-aggregate on real evidence; win32 drain no longer double-reads - #109

…rain no longer double-reads

Two independent fixes, both measured, neither previously on main.

RELEASE-AGGREGATE ELIGIBILITY. 051635a gated stranger-matrix one layer up, which
does not help: when that gate is false stranger concludes `skipped`, the
`workflow_run: completed` event still fires, and release-aggregate runs anyway
against a run that has no artifact. Measured on main — 5 of the last 6 runs red:

  12c29c1 -> failure   Artifact not found: stranger-evidence-12c29c12...
  051635a -> failure   (same, on the commit that supposedly fixed it)
  28fbc44 -> failure
  8f4e17c -> failure (x2)

Only a successful workflow_run or an explicit recovery dispatch is a valid
aggregate input, so the job now says exactly that. Git tags stop at v4.0.8 while
the repo reads 4.0.17-dev and npm latest is 4.0.12 — three surfaces disagreeing
about what exists is what this guard is for.

THE WIN32 DRAIN WAS A FAIL-OPEN REGRESSION. The first version of this branch's
hook-input change called onData(chunk) on what process.stdin.read() returned.
read() ITSELF emits 'data', so the registered listener already had that chunk and
every byte was counted twice. Measured, forcing platform=win32 against a real pipe:

  main            79 bytes  parses OK
  this branch v1  158 bytes PARSE-FAIL   <- payload concatenated with itself

JSON.parse threw, readStdinBounded returned an empty envelope, every gate field
read '' — so the PreToolUse wall FAILED OPEN on every Windows invocation. That is
worse than the held-open pipe it was written to fix: the original bug stalled,
this one waved commands through. CI reported it only as 30 downstream assertions
in codex-lifecycle-hooks and continuation-gate ("expected '' to contain
'ruvnet_cli_help'"), run 30858227845 — the shape of an unguarded parser defect.

Root cause is platform-independent Node stream semantics: attaching a 'readable'
listener pins the stream paused, because resume() computes
`flowing = !readableListening`. The drain is therefore the ONLY byte path on
win32, which is why the double-count was total rather than intermittent.

The drain now drains and nothing else.

GUARDED. tests/unit/hook-input.test.mjs asserts bytes === Buffer.byteLength(env)
across a process boundary with platform forced — magnitude, not direction, since
a doubling passes any non-empty check. Reintroducing the old drain fails it
`expected 158 to be 79`. Verified by doing exactly that. The branch previously
shipped this change with zero tests, which is how a 100%-reproducible defect
reached a required lane invisibly on every non-Windows dev machine.

ADR-0055 currency log records the supersession; ADR-0062 gains the guard and
governs release-aggregate.yml.

Caveat stated plainly: the double-read reproduction forces platform on darwin, so
it exercises Node's stream state machine rather than a real Windows pipe. The
ORIGINAL held-open-EOF symptom is Windows-specific and still needs a real
windows-unit run to prove this fixes it.