[Winterrks]

Follow-ups from the #138 reviews, plus the SDK pin for build 5.

1. dataroots.c: make_plan_view is one walk; every step uses the descriptor the previous step returned (make_plan_dir returns the validated fd), and the epoch scan reads that same folder fd, so nothing is reopened by name and O_NOFOLLOW has a single, testable home. The plan mutants (make_plan_dir, the scan, make_roots) are now actually in the ratchet (the earlier insertion had missed its anchor): 51 dataroots mutants, all killed; out-of-memory/descriptor-exhaustion returns are documented as unmutated.
2. test_filechannel: the root-only sibling test uses a real workspace gid (42000), not root's group 0.
3. verify.py: a receipt that does not claim the environment gitconfig is refused when the cpio ships /etc/gitconfig; the command line requires the claim unless --no-environment (roots older than the gitconfig). Tests incl. the CLI wiring.
4. conversation-set.ts: planScratchEpoch is refused (invalid_request) without the conversation's allocated uids (no shared fixed-pick fallback); tests updated.
5. SDK pin to ec91fe06 (cowork: peer-message receipt ledger over an injected store (unwired) #50 cold-resume owner patch, on top of cowork: guest file channel read side, DTOs and fenced client (unwired) #52 SH6b and cowork: schedule dispatch boundary behind an injected port (refused without one) #49 plan view): sdkCommit, mainAt, workflow AGENT_SDK_HEAD, sdk-supervisor-cli.json, README, and the session-owner library source sha (7630cb1f); supervisor sha unchanged since cowork: guest file channel read side, DTOs and fenced client (unwired) #52. SH6 (Cowork N2: guest side of shares (SH6) #139) is not folded.

Not run here: the Linux-only pid1 cases and the sudo CI step's real-uid half; the bun suites that import workspace packages (no node_modules in the worktree; conversation-set.test.ts passed).