fix: address gadfly swarm review of the executus re-platform

Folds in the real findings the dogfood swarm raised on PR #20 (21 graded
real, 1 false positive):

- tools.go: anchor get_diff `path` matching to whole path tokens (foo.go no
  longer pulls in barfoo.go; a trailing "/" still scopes a directory); split
  the diff once + cache it; drop the spurious trailing blank line; fix the
  "truncated after line N" off-by-one wording. Share one tool-list source
  (allTools) between toolbox() and the executus registry.
- executus.go: drop the dead Config.Defaults caps (per-run RunnableAgent always
  overrides them); shared envBool/reviewTimeout helpers; resolveContextTokens
  logs a failed lookup and uses a 5s timeout (was 15s); note the budget guard
  is pass-granular (the wall-clock backstop covers mid-pass).
- main.go/recheck.go: shared envBool; fix package-doc drift (the removed
  finalization fallback, the paginated get_diff).
- entrypoint.sh/run.sh: export GADFLY_MAX_DIFF_CHARS directly (run.sh prefers
  it); guard the watchdog's delayed SIGKILL on a .disarmed marker so it can't
  catch the consolidation pass.
- tests: anchoring test; corrected obsolete env var + truncation-wording asserts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

entrypoint.sh

@@ -205,7 +205,9 @@ if [ "$HUGE_DIFF_BYTES" -gt 0 ] 2>/dev/null; then
     export GADFLY_MAX_STEPS="${GADFLY_HUGE_DIFF_MAX_STEPS:-12}"
     export GADFLY_RECHECK_MAX_STEPS="${GADFLY_HUGE_DIFF_RECHECK_MAX_STEPS:-8}"
     export GADFLY_RECHECK="${GADFLY_HUGE_DIFF_RECHECK:-0}"               # skip recheck on huge PRs
-    export MAX_DIFF_CHARS="${GADFLY_HUGE_DIFF_MAX_DIFF_CHARS:-20000}"    # run.sh -> GADFLY_MAX_DIFF_CHARS
+    # The Go-visible name directly (run.sh prefers GADFLY_MAX_DIFF_CHARS over its
+    # own MAX_DIFF_CHARS), so the cap is honored without relying on run.sh's alias.
+    export GADFLY_MAX_DIFF_CHARS="${GADFLY_HUGE_DIFF_MAX_DIFF_CHARS:-20000}"
     # Surfaced on each posted comment so the shallower review is self-explaining.
     export GADFLY_NOTICE="⚠️ Large PR (${PR_DIFF_BYTES} bytes): Gadfly downshifted to a focused, single-model review to stay within budget — coverage is intentionally shallower. Consider splitting the PR for a deeper review."
   fi
@@ -333,7 +335,7 @@ fi
 # findings were gathered are still posted and the job never fails (advisory).
 # GADFLY_PR_BUDGET_SECS=0 (default) disables it.
 KILLER_PID=""
-rm -f "${WORKDIR}/.budget_killed" 2>/dev/null || true
+rm -f "${WORKDIR}/.budget_killed" "${WORKDIR}/.disarmed" 2>/dev/null || true
 if [ "${GADFLY_PR_BUDGET_SECS:-0}" -gt 0 ] 2>/dev/null; then
   (
     sleep "${GADFLY_PR_BUDGET_SECS}"
@@ -342,7 +344,10 @@ if [ "${GADFLY_PR_BUDGET_SECS:-0}" -gt 0 ] 2>/dev/null; then
     pkill -TERM -f '/usr/local/bin/gadfly' 2>/dev/null || true
     pkill -TERM -f "${SCRIPTS_DIR}/run.sh" 2>/dev/null || true
     sleep 5
-    pkill -KILL -f '/usr/local/bin/gadfly' 2>/dev/null || true
+    # Guard the delayed SIGKILL on the disarm marker: once the lanes finished and
+    # the watchdog was disarmed, the consolidation gadfly pass runs next, and a
+    # name-based KILL here must NOT catch it.
+    [ -f "${WORKDIR}/.disarmed" ] || pkill -KILL -f '/usr/local/bin/gadfly' 2>/dev/null || true
   ) &
   KILLER_PID=$!
   log "PR budget watchdog armed (${GADFLY_PR_BUDGET_SECS}s, pid ${KILLER_PID})"
@@ -360,8 +365,13 @@ done
 [ "${#LANE_PIDS[@]}" -gt 0 ] && wait "${LANE_PIDS[@]}"
 
 # Reviews finished (or the watchdog killed them): disarm the watchdog so its
-# delayed SIGKILL can't catch the consolidation pass that runs next.
-if [ -n "$KILLER_PID" ]; then kill "$KILLER_PID" 2>/dev/null || true; fi
+# delayed SIGKILL can't catch the consolidation pass that runs next. Drop the
+# disarm marker FIRST so even a racing watchdog that already reached its KILL line
+# skips it (the kill below also tears the watchdog subshell down during its sleep).
+if [ -n "$KILLER_PID" ]; then
+  : > "${WORKDIR}/.disarmed"
+  kill "$KILLER_PID" 2>/dev/null || true
+fi
 
 # If the backstop fired, note it on the consensus comment (per-model comments
 # were already posted during the run; a killed model surfaces as a failed lane).