[dane1599d]

This cherry-picks #716 (main 76e6064, branch head f8aa000) onto release/v0.1 at 8530362. #716's merge diff applied cleanly.

It covers the two shapes the shipped-pack actbench found in #715:

• A call whose target argument is a placeholder (pkg_remove("package_name")) runs nothing. The shell asks which one is meant, and a script that holds such a literal is refused.
• A script with no change that prints a success claim gets a closing line: "Nothing was changed: the script made no change."

It's shellcore only: guard.rs, its tests, and the hooks in actions, agentcore and lib. On release it sits after #731's telling-line refusal, as it does on main: the placeholder check runs first, then the telling-line refusal, then the tier.

Gates on main (#716):

• Fluency: 48/50.
• Shipped actbench: 113/142 at seed 42 against 111 (two re-runs, both 113).
• C: OK.

Test plan

• The local door on this branch, at 0bc8b41
• Lint and full-ci on release/v0.1 (labelled)

The manager merges this by hand.