Adopt agentseam 0.3.4: PowerShell shell matcher, Codex write gate, clean verdict channel

[jothimani-rajendran]

What

This PR moves the pin to agentseam==0.3.4 (now on PyPI) and regenerates everything that depends on it.

• Claude Code: the shell matcher becomes Bash|PowerShell. Claude Code's default shell tool on Windows is PowerShell, so guards that matched only Bash never fired there.
• Codex: a new codex_cli-write-hooks.json adds a pre-write gate on apply_patch.
• Stdout: a policy handler's stray stdout can no longer turn a deny into an allow. agentseam diverts stdout and fd 1 while a handler runs.
• Copilot CLI: its camelCase payloads are read.
• Name clash: inside the single-file runtime, chock's edit_image._tool_input shadowed agentseam 0.3.4's new vscode_copilot _tool_input, so every Copilot guard and gate allowed everything. It is renamed to _edit_call_input, and test_chock_handler_shadows_no_agentseam_name[agent] fails on any future clash.
• Copilot PowerShell entries:
  • Copilot's powershell/windows keys are & <launcher cmd>; if ($null -eq $LASTEXITCODE) { exit 2 }; exit $LASTEXITCODE.
  • The $null guard is new in this PR (2f85287). With git or sh missing, no native command runs, and exit $null would be 0, which is an allow. This matches the fix in 0.3.4: keep the verdict channel clean, read Copilot CLI's camelCase, keep PowerShell exit codes agentseam#161.
• requirements/brand-assets.txt pins agentseam 0.3.4 (recompiled with --upgrade-package agentseam; no other pin moves).
• Merged main (Portable agent hooks: one committed launcher, and gates that refuse when they cannot judge #172). The generated wiring and goldens are regenerated. The launcher test keeps both main's every-shell case and this branch's unwrap of PowerShell-only fields.

Definition of done

• chock check → 0 failures
• chock check --only matrix passes (part of chock check)
• chock sync --repo . --check clean
• chock check --only verify clean
• Registry rescanned; no stale entries (CI registry freshness check)
• pytest -q green (1596 passed, 3 skipped, agentseam 0.3.4 from PyPI); the shadowing test covers every vendor runtime
• Acceptance suite green (21 passed)
• Existing artifacts migrated in this PR (chock's own wiring regenerated)
• Changelog entry under Unreleased
• ruff check . and ruff format --check . clean

Claims

• No surface is described as enforcing more than it installs

After this merges, chock is ready to release (probably 0.12.0). chock-catalog's .framework-ref then gets re-pinned to that tag.

🤖 Generated with Claude Code

https://claude.ai/code/session_016DapRw9Ce9z6jRd11uiuyu

---

Generated by Claude Code