[TASK] Edge-case AC validation (AC-10/12/13/18/29)

[kirich1409]

Context

Integration tests covering remaining 0.1 AC not covered by individual module tests.

Acceptance criteria

• AC-10 (TOCTOU re-validation) passes.
• AC-12 (SymlinkPolicy reject) passes.
• AC-13 (RiskLevel typed confirmation) passes.
• AC-18 (non-TTY --allow-danger abort) passes.
• AC-29 (invocation token-redact) passes.

Files to touch (estimate)

best-effort estimate; agent refines during implementation

Implementation notes

n/a

Dependencies

• Blocked by [TASK] restore subcommand + session-id validation #77
• Blocked by [TASK] git.worktrees heuristic + plan #82
• Blocked by [TASK] js.node_modules-lite plan emits .hint only (no trash) #84

Safety checklist

See .github/ISSUE_TEMPLATE/task.yml — tick applicable invariants in the issue if any destructive path is touched.

Definition of Done

• Acceptance criteria satisfied and verifiable
• Tests added or updated
• No build / lint / test regressions
• Self-review against research-report invariants
• Code review approved