Fix the command gate's blind spot, and make --json actually be JSON

A reviewer reported seven drifting commands in the evidence record. Reproduced, the report split
three ways, and the middle category was the useful one: the gate had been scoring them clean.

Not reproducible, with the measurement:

  tests/run_tests.py -q   runs. The wrapper forwards its arguments to pytest
                          (`args = list(argv[1:]) or ["-q"]`), and documents that in its own usage.
  dcc.py                  already written as `cd tools/_work/bench/repos/dcc` followed by
                          `python dcc.py ...` -- an external checkout, not a shipped script.

Real, and fixed here: seven commands in two evidence records named a **workbench** script with no
path at all (`analyze_pair.py`, `make_skeleton.py`, `ttd_attach.py`, `b2_measure.py`). The files
exist under `tools/`, which .gitignore excludes, so a reader copying one from the repository root
gets "No such file" -- and two of those documents wrote the correct path elsewhere, so they
disagreed with themselves.

**The actual defect was in `check_commands.py`, not in the seven lines.** `resolve_script()` tried
the document's own directory first, so a bare `analyze_pair.py` inside `docs/tool-verification/`
resolved to `tools/_work/bench/unpack/b3/analyze_pair.py` -- a real file -- and passed. Resolution
now follows the order a reader would try (repository root, then the skill's scripts, then the
document's own directory, which is what `../x.py` in a nested README legitimately means); a bare
name that only resolves under `tools/` is `unqualified-workbench`; and that class counts as **drift,
not as a skip**, because it is a one-token fix that a reader cannot run. The first attempt classified
it as a low-confidence warning, which would have left all seven in place.

One exception is honoured and pinned: a code block opening with `cd tools/_work/bench/repos/dcc` is
telling the reader where to stand, so a bare `python dcc.py` after it is correct.
`documented_commands()` now reports whether a `cd` preceded the command in the same block, and that
case is skipped as `workbench-after-cd`.

Two defects of this pass's own, found while fixing it:

  --json emitted the RESULT= token after the JSON document, so `--json | jq` failed with "Extra
  data". The token is gone from that path; the status is a field in the document, and the exit code
  carries the same meaning.
  The fix's own substitution left four literal backslashes before `$` in the two files it edited --
  a character a reader would copy by mistake. Removed, and verified absent.

`tests/integration/test_check_commands_gate.py` pins the resolution order, the drift classification,
the `cd` exception, and a clean pass over the committed tree, so this cannot come back silently.

Gates: check_commands 153 checked / 0 drift, check_repo 0 problem, check_refs 0 dangling / 0 warning,
check_routing coherent, check_budget 0 failure / 0 warning, pytest 613 passed / 158 skipped / 25
xfailed.

docs/tool-verification/EXTENSION-benchmark-l1-l3.md

@@ -427,7 +427,7 @@ for the OK button.
 needs:
 
 ```
-$ python ttd_attach.py --package <PKG> --activity sg.vantagepoint.uncrackable3.MainActivity \
+$ python tools/_work/bench/l1l3/ttd_attach.py --package <PKG> --activity sg.vantagepoint.uncrackable3.MainActivity \
       --js l3_read_crc.js --launch-delay 1.5 --seconds 20
 [i] pre-attach main pid=7020 at 1.88s
 [i] attached at +0.00s (probe loaded)
@@ -523,7 +523,7 @@ the expected original bytes before each write.
 Patched condition:
 
 ```
-$ python b2_measure.py --js l3_hook_patch_v2.js --tag PATCHED --probe-seconds 25
+$ python tools/_work/bench/l1l3/b2_measure.py --js l3_hook_patch_v2.js --tag PATCHED --probe-seconds 25
 [i] spawned pid=10000 (paused)
 [i] resumed pid=10000
 [0.04s][i] libfoo.so base=0x764b89d000 size=90112
@@ -545,7 +545,7 @@ I/Zygote( 1007): Process 10000 exited due to signal 6 (Aborted)
 Control condition (identical reads and writes, original bytes written back):
 
 ```
-$ python b2_measure.py --js l3_hook_control_v2.js --tag control_v2 --probe-seconds 22
+$ python tools/_work/bench/l1l3/b2_measure.py --js l3_hook_control_v2.js --tag control_v2 --probe-seconds 22
 [0.04s][CONTROL] 0x2ff0 unchanged (wrote back 40 1a 80 52 c0 03 5f d6)
 [0.04s][CONTROL] 0x2ff8 unchanged (wrote back c0 0c 80 52 c0 03 5f d6)
 [0.04s][CONTROL] 0x3080 unchanged (wrote back fd 7b bf a9 fd 03 00 91)

docs/tool-verification/EXTENSION-extraction-shell-bench.md

@@ -44,7 +44,7 @@ A byte diff of the pair (`tools/_work/bench/unpack/b3/analyze_pair.py`) locates
 difference:
 
 ```
-$ python analyze_pair.py
+$ python tools/_work/bench/unpack/b3/analyze_pair.py
 len A=12536 len B=12536
 first diff offset = 8 (0x8)
 diff byte count = 6
@@ -83,7 +83,7 @@ the tail is nop-filled, so offsets, class table and string table are untouched a
 header is re-fixed with `dexutil.fix_dex_header` (signature first, checksum last).
 
 ```
-$ python make_skeleton.py src-r2pay.dex skel
+$ python tools/_work/bench/unpack/b3/make_skeleton.py src-r2pay.dex skel
 source: src-r2pay.dex
   ctrl.dex           fraction=0.00 mode=return   emptied=0/5061
   skel-25.dex        fraction=0.25 mode=return   emptied=1265/5061

docs/tool-verification/EXTENSION-reconstruction.md

@@ -292,7 +292,46 @@ Defect 1 is the instructive one: a checker whose parser silently shortens a comm
 for exactly the inputs it was written to reject, and nothing in its own output looks wrong. The
 defence is not more careful reading, it is a fixture that is known to be bad.
 
-### 2.6 What this check does not cover
+### 2.6 A second blind spot, found by a reviewer reading this gate's output
+
+A reviewer reported seven "drifting" commands. Reproducing them split the report three ways, and the
+middle category is the one worth reading.
+
+**Not reproducible.** `python tests/run_tests.py -q` runs: `run_tests.py` forwards what it is given
+to pytest (`args = list(argv[1:]) or ["-q"]`), and its usage block documents exactly that. `dcc.py`
+is written as `cd tools/_work/bench/repos/dcc` then `python dcc.py ...` — an external checkout, not a
+script this repository ships.
+
+**Real, and fixed.** Seven commands in two evidence records named a **workbench** script with no path
+at all (`$ python analyze_pair.py`, `b2_measure.py`, `ttd_attach.py`, `make_skeleton.py`). Those files
+exist under `tools/`, which `.gitignore` excludes, so a reader copying the command from the
+repository root gets `No such file`. Two of those documents wrote the correct path elsewhere, so they
+disagreed with themselves.
+
+**The part that matters: this gate had been scoring those `ok`.** `resolve_script()` tried the
+*document's own directory* first, so a bare `analyze_pair.py` inside `docs/tool-verification/`
+resolved to `tools/_work/bench/unpack/b3/analyze_pair.py` — a real file — and passed. The fix is not
+a stricter regex but a corrected resolution order plus a corrected classification:
+
+1. Resolution now follows the order a **reader** would try: repository root, then the skill's script
+   directory, then the document's own directory (which is what `../x.py` in a nested README means).
+2. A bare name that only resolves under `tools/` is `unqualified-workbench`, and it counts as
+   **drift, not a skip** — a one-token fix that a reader cannot run. A first attempt classified it as
+   a low-confidence warning, which would have left all seven in place.
+3. The one honest exception is pinned too: a block that opens with `cd tools/_work/bench/repos/dcc`
+   tells the reader where to stand, so a bare `python dcc.py` after it is correct. That is skipped as
+   `workbench-after-cd`.
+
+**Two defects of this pass's own, found while fixing it.** A `--json` run printed the `RESULT=` token
+*after* the JSON document, so `--json | jq` failed with `Extra data`; the token is gone from that path
+and the status is a field in the document instead. And the fix's own substitution left four literal
+backslashes before `$` in the two files — a reader would have copied them.
+
+`tests/integration/test_check_commands_gate.py` pins the resolution order, the drift classification,
+the `cd` exception, and a clean pass over the committed tree, so this blind spot cannot return
+silently.
+
+### 2.7 What this check does not cover
 
 - It validates **flags and (weakly) positional counts**, not semantics. A command with correct flags
   and a wrong path still passes; so does a documented `--duration 14` where the useful value is