v1.13.0 — post-section TASK_BASE_REF, trust guard, committed-range (D142/D147)

Ports all three of the canonical stride plugin's D142 base-ref / snapshot fixes (stride v1.36.0) into the Pi hook bridge. TASK_BASE_REF was captured at claim time — before runHook ran the ## before_doing section's git pull — so the after_doing changed_files diff spanned commits pulled from another clone (D132/W1678), and the W1529 dirty-baseline filter dropped committed task work (D137). Per ADR-002 all new logic lives in the pure, unit-tested modules; index.ts only wires them.

Fixed

• D132 (reorder + trust marker). resolveClaimEnvCache now persists task identity only and strips any inherited TASK_BASE_REF/TASK_BASE_REF_TRUSTED; a new pure resolveFinalizeBeforeDoingEnv writes the base + trust marker, called from index.ts after runHook returns (regardless of exit code), re-recording the dirty baseline against the post-pull tree.
• D132 (trust guard). New exported resolveSnapshotBase(baseRef, cwd, trusted) — the three reference rules with the trusted-marker gate on rule 3, a loud console.error recompute, and a no-origin passthrough. finalizeAfterDoing and selfHealChangedFilesUpload resolve it once per task window and persist it as a base= line in .stride-diff-upload-state, reusing it so an after_doing git push cannot recompute a correct base to HEAD and empty the snapshot.
• D137 (committed range). captureChangedFiles overrides the dirty-baseline exclusion for any path in the base..HEAD committed range: committed range = task work.

Testing

npm test (node --test) grows from 195 to 213 tests, all passing. New coverage in the pure modules: resolveSnapshotBase over a two-clone bare-origin cross-pull fixture, the committed-range override, the base= round-trip, readFinalizerEnv trust-marker parsing, the inverted env resolvers, and two finalizeAfterDoing integration tests. The new tests reference resolveSnapshotBase (absent pre-fix), so they fail by construction against old code.

Backward compatibility

Backward-compatible and additive. The TASK_BASE_REF_TRUSTED cache key and base= state line are tolerated when absent. No marketplace — the extension installs via a github: ref pin.