code-to10 v5: solidify 7 provisional resolutions per user confirmation (2026-11-02)

- whitelist expansion (tr + exit builtin) confirmed, comment only
- B4 viewport wording: temp banner removed, wording untouched,
  change-list table stays in draft, not merged into body
- B3-tail (a)/(b): no content change (bullet still absent), recorded
  as decided; v2 record showed it unselected, no side picked here
- section 4: 6 templates/artifacts/ refs deleted per signed verdict;
  tripwire test updated 6 -> 0 to pin the new inventory
- CHANGELOG pointer line kept, no marker present
- workers audit landing migration confirmed, comment only
- verify-script gate evidence confirmed, gate hard untouched
- 2 temp stances NOT touched: actual-only quota, evidence binding
  not enforced / no anti-restamp
- behavior code unchanged; directional skill tests 39/39 OK

host.py

@@ -1422,12 +1422,9 @@ VERIFY_COMMAND_ALLOWLIST = frozenset({
 # “白名单不是沙箱”）、cd/export/time（shell 内建，改 cwd/环境，
 # 请用 VAR=val cmd 形态或 host 自身的 cwd）。
 #
-# 临时消解（v2 provisional，待用户确认后才算定）：#256 白名单 ×
-# #263 旧 shell 语义碰撞——本轮临时选“白名单扩围”一边，见下
-# _VERIFY_SHELL_BUILTINS。另一边（旧测试按新语义更新：管道改
-# grep、exit 3 改 python3 -c sys.exit）的代价是丢掉“任意退出码
-# + 管道过滤器”这组旧 shell 语义的直接证据，且改的是 #263 已
-# 定测试的期望；若用户最终选旧测试更新一边，本处扩围须 revert。
+# 已确认（v5 用户定稿 2026-11-02）：#256 白名单 × #263 旧 shell
+# 语义碰撞——定稿选“白名单扩围”一边，见下 _VERIFY_SHELL_BUILTINS。
+# 另一边（旧测试按新语义更新）未选。
 _VERIFY_DENIED_RC = 126
 # 仅有的白名单内建命令：exit。它不是外部程序（simple 路走
 # shell=False 会因找不到可执行文件而抛错），只能走 shell 路；