v5.11.50 — torture-room follow-ups + release integrity

Torture-room follow-ups + release-integrity

A full cross-platform / cross-runtime audit (macOS, Linux, Windows Git-Bash & no-bash, WSL, Umbrel; Claude Code marketplace + script, Codex, Hermes, OpenCode, OpenClaw) of the 5.11.47-49 work confirmed no blocking issues on any platform — every hook path fail-opens and never blocks a tool call. It surfaced three follow-ups, all fixed here, plus restored release integrity.

• Perf regression fixed (all platforms). The 5.11.46 content-based outsourcerer
  detection left its one-time backfill driven by WHERE is_sidechain = 0, which
  matches every human session forever — so it re-read up to 200 lines of every
  human transcript on every DB init (twice per session end). It's now gated by
  a persistent completion marker: the migration content-scans transcripts exactly
  once. Users with large session histories get their turn-end overhead back.

• Statusline shows live effort. /effort changes now reflect immediately —
  the statusline reads the live session effort from Claude Code's stdin payload
  (effort.level) instead of only the persisted settings.json value, so a
  session-only /effort max shows max instead of the stale hi. Falls back to
  settings.json on older Claude Code. Added xhigh -> xhi.

• Codex launcher guard. The version-resolving Codex hook guard checked the
  launcher for the execute bit, but bash only needs to read it — corrected so
  a readable-but-not-executable launcher isn't wrongly skipped.

• Release integrity restored. CHECKSUMS.sha256 is regenerated and attached to
  this release, so the verified install.sh path works again (it fetches the
  release's checksum manifest and aborts on mismatch/absence).

Complements 5.11.48 (script-install Windows hooks) and 5.11.49 (marketplace Windows
interpreter cache).