fix(supervision): render the drain/ack contract once as a neutral stanza

[harmeet-1337]

Summary

Fixes accepted simplification-audit finding F-S16-2 (P0): the harness-neutral drain-and-acknowledge step was copy-pasted into every per-harness supervision-protocol snippet under docs/supervision-protocols/ and had drifted. cursor.md had dropped the "and unread status lines" clause and the UNREAD STATUS drain entry, telling Cursor primaries a weaker supervision contract than every other harness.

Change

• bin/fm-supervision-instructions.sh: print the drain/ack contract exactly once as a neutral stanza (drain_ack_stanza) in the renderer preamble, immediately before the ordinary-wake line, using the strongest wording from claude.md verbatim (including "and unread status lines" and the exact WAKE_ACK_REQUIRED --ack-through instruction).
• Delete the duplicated step 1 from the six named snippets (claude, codex, grok, opencode, pi, cursor) and unknown.md's paraphrase, renumbering the remaining steps.
• Restore the UNREAD STATUS mention that cursor.md was missing in its surviving wake-record sentence (the actual drift).
• Add a test asserting the rendered block contains WAKE_ACK_REQUIRED exactly once for every harness, including the unknown fallback.
• Sync docs/turnend-guard.md's regression-coverage line for the renderer test.

Out of scope (deliberate)

• The repair-line and ordinary-wake switches are owned by a separate finding and are untouched.
• The claude repair sentence pinned byte-for-byte by tests/fm-turnend-guard.test.sh is unchanged.
• The SC2016 shellcheck-disable on the two printf lines is intentional and matches existing repo convention (bin/fm-startup-network.sh, fm-operational-input.sh): the backticks are literal instruction text, not command substitution.

Validation

Validated through the no-mistakes pipeline: intent, rebase, review (approved), test, document, and lint all completed. The review flagged that the neutral stanza renders unconditionally; this is behavior-preserving (the renderer already emits the ordinary-wake line and full snippet unconditionally) and matches the audit's explicit placement directive, so it was approved as-is. The lint step's exit-1 was solely the pipeline environment lacking ShellCheck on PATH; the branch is verified clean against the pinned ShellCheck 0.11.0 and actionlint 1.7.12 (bin/fm-lint.sh exits 0). The upstream push returned 403 (read-only account), so this PR is delivered from a fork; every step before push ran exactly as the pipeline produced it, and no out-of-scope commit was auto-injected.

[greptile-apps]

Confidence Score: 4/5

The unconditional drain/ack stanza should be brought back under the supervision-ownership and away-mode condition before merging.

The consolidated text is emitted for read-only and away-mode sessions even though draining and acknowledging durable wakes is ownership-gated, so the rendered instructions can direct a non-owner to consume another supervisor’s work.

Files Needing Attention: bin/fm-supervision-instructions.sh

_{Reviews (1): Last reviewed commit: "no-mistakes(document): sync turnend-guar..." | Re-trigger Greptile}

[greptile-apps]

Drain escapes ownership scope

When the block is rendered for a read-only session or while away mode owns supervision, the unconditional drain_ack_stanza instructs that session to drain and acknowledge durable wakes, causing work to be consumed or acknowledged before the active supervisor handles it. Keep this instruction under the same ownership and away-mode condition that previously scoped it in each harness snippet.