fix(newos4): one arg-coercion boundary + binary-safe gunzip + clean boot log (v4.6.159)

1. Tool arguments are coerced once, at the dispatch boundary (module-aiassist.js)
   - _coerceToolArgs(name, a) at :1584 reads the tool's own JSON schema and, for every
     declared string prop, converts number/boolean with String() and object/array with
     JSON.stringify (never "[object Object]"); declared integer/number props accept
     unambiguous numeric strings. null/undefined stay absent so the handlers' defaults
     and _pathArg still own "no value given".
   - Called at both dispatch boundaries: runTool (:2650) and runModuleTool (:3565 —
     reachable from view_module and from ship_module -> test_module/health_check, which
     have their own parse+switch).
   - A JSON body of "null" or "[1,2]" parses to a non-object; both sites normalise to {}
     before any handler reads a.field.
   - The 26 handlers keep their `a.x || ''` reads: `|| ''` catches only FALSY, which is
     how a truthy number or object reached .trim()/.split()/.replace() and filed one
     auto-report per tool (user_get "key.split is not a function", create_skill,
     patch_skill, delegate_task "task.substring is not a function", create_mindmap,
     web_fetch, list_skills, ship_module).

2. gunzip is binary-safe (cryptogzip.js — plan 2026-11-03 T3, the last open task)
   - _cmdGunzip used _vfsRead + _gunzipString (base64-only), so a real .gz fetched with
     wget reported "not valid base64 input (illegal character \u001f)" and could not be
     decompressed at all. It now reads bytes (_vfsReadBytes handles both the module's
     base64 output and raw Latin-1 bytes), checks the 1f 8b magic, and reports
     "not a gzip file" for non-gzip input without writing or deleting anything.
     The module's own gzip output still round-trips.

3. Boot log is clean (terminal.js)
   - Seven _safeRegister() calls for Editor/Shell/Alias/Finder/FileManager/Diff/BusyBox
     were guaranteed no-ops: those classes are declared in critical-ext-bundle.js, a
     <script> after module-loader.js, so they do not exist yet when new WebX11Terminal()
     runs; adding them to the registry map would still resolve to undefined. Removed with
     a comment — the ext bundle registers each one on load.
   - SimpleGUIModule IS a core class but was missing from _safeRegister's registry map,
     so the fallback could never restore it. Added.

4. New guard: admin/scripts/verify-plan-age.py + profile wrapper plan-age-guard.sh
   (cron newos4-plan-age-guard, no_agent, daily 07:10). Silent when healthy; reports
   plans marked <!-- autonomy: review --> with no execution stamp older than 72 h —
   the process gap that let four fix plans sit for six days before v4.6.158. Read-only
   by construction (148 real plans byte+mtime identical before/after a run), rc=2 when
   the directory cannot be scanned, --strict opt-in so a report is never recorded as a
   crashed guard.

Verified: 37/37 node tests, 3 new test files and 631 new assertions (613 arg-coercion,
18 gunzip); test-cryptogzip-guard's C8 updated because it pinned the old misleading
"not valid base64" message. Independent orchestrator checks: all 66 declared string
props across 58 tool defs coerced under 4 hostile shapes; positive cases untouched
(string content not double-encoded, numbers still numbers, null still absent, unknown
tool identity preserved). Served bytes byte-identical for core-bundle.js, main.html and
cryptogzip.js. Live Chromium on v4.6.159: write_file with object content wrote 27 chars
of readable JSON (not "[object Object]"), read_file with offset:"0"/limit:"200" coerced
to numbers, user_set with key 12345 -> "12345" and object value -> JSON, and the boot
log now carries 0 SafeRegister warnings (52 messages, 0 JS errors) with SimpleGUIModule
registered.

0 files changed, 0 insertions, 0 deletions