v0.2 follow-ups: effective-model cache staleness, host-runner integration test, substitution conservatism

This issue combines independent follow-ups rather than one bounded change. Start by tracing the verdict cache signature and resolved-model handling, then inspect tests/fixtures.ts for the current direct tool_call path; the cache fix is done when effective-model changes cannot reuse stale verdicts, while the host-runner test and substitution refinement depend on the stated scope decisions.

Accepted limitations and follow-ups from the v0.2 landing (PR #5, luna reviews pass 1-3). The merge gate is green CI + all three blocking findings from the reviews fixed; the items below are known scope edges, deliberately not blockers.

1. Effective-model cache staleness. Cached verdicts key on config fields (enabled/model/timeoutMs/maxCommandLength) and clear on change, but the RESOLVED model can change mid-session (@tiny role remap or a session-model switch) without changing the signature. A cached SAFE survives an effective model change for commands outside the moderate-risk overlay. Fix direction: include the resolved model id in the cache signature.

2. Host-runner integration test. The suite drives the captured tool_call handler directly through tests/fixtures.ts, so host handler aggregation, timeout conversion, and native approval are not exercised end-to-end. Acceptable while the host is externally owned; revisit if the fork ships this plugin.

3. Command-substitution conservatism. Any command containing $( or a backtick plus a risk verb spelled anywhere is flagged (prompt), because tokenizeShellSegments explicitly excludes command substitution. Benign forms like echo $(date) stay clean; grep $(git rev-parse HEAD) log would prompt. If prompts get noisy, narrow to substitutions containing a risk verb INSIDE the parens rather than anywhere in the text.

4. Later-handler input revision (documented, not fixable plugin-side): another extension's tool_call handler can revise the command after this plugin judges it; native approval applies to the revised command outside yolo. README "Gate integrity and its limits".

5. Lexical matcher ceiling. The overlay normalizes quotes, backslash-newline, wrappers, attached redirects, and git option positions, but exotic spellings ($'\t' escapes, aliases, base64 | sh chains) remain a classifier-judgment matter by design. The fail-closed path is: anything unparseable still reaches the human via UNSURE/PARSE_ERROR.