refactor: one transcript reader, and stop printing into every session

[imkp1]

What this changes

Removes duplicated code across the capture path, and fixes two things that
duplication was hiding.

One transcript reader. transcript.extract (stage 0) and
dialogue.extract_dialogue (stages 2/3) walk the same file for different
subsets and had drifted into two copies of one loop. Five things were defined
twice — the parse-and-skip-partial-lines scan, the promptSource filter, the
message-content unwrap, the edit-tool path pull, and EDIT_TOOLS — and now
have one definition each in transcript.py.

One quote normalizer. _normalize existed in both triage.py and
seed.py, written differently, for the same job.

The shim stops printing into every session. grask shim printed a success
line on stdout. A SessionStart hook's stdout is injected into the session's
context and shown to the developer.

The approval hook matches the shape it approves. approve.py accepted
record 1 2 3, record ../../etc/passwd, and a bare record.

Plus: ask._unservable → ask.unservable (cli.py has always called it across
the boundary), a docstring paragraph deduped between _serve and
_next_payload, and .DS_Store / .idea/ / brag-output/ gitignored.

Why

The two extraction copies were not symmetrical, which is how this kind of
duplication actually fails: the block-list guard on human turns existed in only
one of them. That filter is load-bearing — it is the only thing separating a
turn the developer authored from injected skill text — and a second copy of it
is a second thing that can be wrong.

The two _normalize implementations agreed today and nothing held them
together. Both check a model-claimed quote against what the developer typed, at
stage 1 and stage 2. A quote stage 1 evidences and stage 2 cannot find costs
the whole seed, silently, at the last stage that could still have produced a
question.

The shim line is the one with a per-session cost. It is not a large number of
tokens, but it is spent in every session in every project, on a notification
about grask's plumbing, charged to the context window of work that has nothing
to do with grask. Success is now silent; only the failure has anything to say,
and it says it on stderr.

approve.py is the file where a loose rule costs something. It spends the
developer's standing approval on a Bash command without prompting, and its own
docstring claimed "only record takes a positional, and only one: the probe
id" while accepting three shapes that were not that. Nothing here was
exploitable — argparse refuses all three downstream — but an approval rule that
merely resembles the shape it approves is not doing the job it claims to.

On the rules enforced in code rather than prompted for: none moved. The
evidence rule, the one-question rule, and the option gates are untouched. The
promptSource filter and the quote check were each enforced in code twice;
they are now enforced in code once, which is the same rule with one fewer place
to break.

Checks

• uv run pytest passes — 348 passed, 1 deselected (was 341)
• uv run ruff check . passes
• uv run mypy passes
• New behaviour has a test that fails without the change — shim silence,
  the three record shapes now refused, and both readers agreeing on human
  turns
• No test added here calls a real model (calibration-marked tests excepted)
• Nothing derived from a real transcript appears in the diff — fixtures,
  logs, or commit messages

Additionally, both readers were verified byte-identical to the pre-refactor
logic across 120 real transcripts on disk (turns, files touched, cwd, branch).
That check read from ~/.claude/projects and is deliberately not committed;
nothing it read appears in this diff.

🤖 Generated with Claude Code