fix: close money-movement gaps in subprocess env, withdraw, and trade plans

[VickyXAI]

Summary

• Subprocess env: Bash, Detach, tool/spend hooks, MCP stdio servers and git/rg helpers no longer inherit BLOCKRUN_WALLET_KEY, BASE_CHAIN_WALLET_KEY, SOLANA_WALLET_KEY or BLOCKRUN_API_KEY (shared sanitizeSubprocessEnv). Before this, a model-written script could load the wallet key from env and sign transfers that no trade-plan, PreSpend or budget gate saw. Env written explicitly into a user's own MCP server or hook config still passes through.
• Polymarket withdraw: only pays the agent wallet; any other to_address is refused before any network call or signature.
• Double-send guard: pendingWithdraw is persisted before submission on both paths, closing the accepted-but-unacknowledged window. A relayer marker with no transactionID blocks until deadline + grace. On the EOA path, the tx is signed locally, its hash is persisted, then it is broadcast. A retry re-broadcasts the same signed bytes and never signs anew. The guard releases only on a receipt, on a definite RPC rejection of bytes the RPC doesn't know, or when the nonce was consumed by a different transaction.
• Trade-plan gate: coverage binds to the execution fields instead of a substring match across all inputs. It enforces action and direction, plus a per-line cap in integer micro-dollars. Calls whose USD amount can't be determined fail closed. Drawdown debits the plan that authorized the call (WeakMap on the invocation, kept out of tool input and transcript), even if that plan expired or a newer one was approved. A consumed line can't run again. Polymarket outcome labels can no longer stand in for a market.
• System prompt: new always-on "Ambiguous payment outcomes" rule. A timeout, a 5xx or a lost response after a send counts as unknown, not failed. The agent must reconcile (receipt, nonce, balances) before any new send, may only re-broadcast the same signed transaction, and must report every attempt and settlement. This covers payments made through Bash scripts and MCP tools, where no code-level guard exists.
• Review follow-up:
  • A withdraw retry that resolves the earlier attempt reports the outcome and stops; it never signs a second withdrawal in the same call.
  • No "dropped" inference from nonce movement; only a receipt resolves an EOA withdrawal.
  • Plans saved before per-line accounting that were already drawn on are refused, and decideTradePlan re-reads the stored plan.
  • Trade budget is reserved at the gate and released only on notSubmitted (or a pre-execution denial).
  • A Polymarket submit that fails without a 4xx keeps the plan reservation and the session cap, and is reported as outcome UNKNOWN.

Notes

• src/tools/polymarket/* changes are marked franklin-local: and need upstreaming.
• Behavior change: an MCP server that relied on inheriting BLOCKRUN_WALLET_KEY must now set it in its own config env.
• Known limits, not addressed here: key files under ~/.blockrun are still readable by the same OS user from a shell; there is no cross-process lock on plan/state writes (TODO left in the code); the Polymarket fund path has no retry record.

Test plan

• npm test: 847/847 pass
• New test/subprocess-env.local.mjs: real printenv through Bash, both Detach stages, hooks, MCP
• New test/withdraw.local.mjs: external recipient refused pre-network, marker written before submit on both paths, lost acknowledgement blocks a second withdrawal, EOA re-broadcast / release rules, persistence failure prevents submission
• test/trade-plan.local.mjs: memo mention denied, outcome-label hole closed, action/direction, per-line cap, authorizing-plan drawdown
• New test/orders.local.mjs: unknown submit keeps reservation and is not notSubmitted; 4xx / success:false release and are notSubmitted
• Prompt test: the rule ships in the assembled instructions
• Mutation-checked: reverting the outcome-label fix, the definite-rejection condition, resolution-ends-call, the legacy-plan check, stale-plan re-read, the unknown-submit reservation and the plan error-release each makes a test fail