fix: launch identity false-positive + resolver race (iss-31)

[REPPL]

Resolves ledger issue iss-31 launch-dogfood-gate by addressing all three named acceptance-corpus instances, detector-first.

The three instances

#	Instance	Disposition
1	Identity scanner hard-fails on /dev/null (local-username false positive)	Fixed
2	Launch payload omits skills/	Stale — no skills/ dir; reclassified to commands/abcd/ (2026-07-11), ships via the commands include
3	globRegexpCache unsynchronised package-level map (data race)	Fixed

The fixes

• Identity false positive (internal/adapter/scanner/identity.go): when the machine username equals a system directory name (e.g. a user called dev), the local-username matcher flagged dev inside /dev/null, hard-failing the launch scan. isSystemPathSegment suppresses a local-username match only when the matched text is a well-known system-dir name and the top segment of an absolute path (/dev/…). Genuine leaks — nested under a home root (/Users/dev/…, /home/dev/…), bare (dev), or dev@host — are still caught, and the suppression is scoped to local_username only (home_path_self remains the backstop for a home-dir-named user).
• Resolver race (internal/core/launch/bundle.go): the compiled-glob cache is now guarded by a sync.RWMutex (read lock on lookup, write lock on store). A concurrent miss may compile a pattern twice — benign.

Detector-first evidence

• The identity FP was proven against a live abcd launch --dry-run: the scan's /dev/null hard-fails drop 2 → 0.
• TestIdentityLocalUsernameSystemPathSuppressed — asserts /dev/null is not flagged, and that /home/dev/data and a bare dev still are (false-negative controls). Watched fail before the fix (Matched:dev), passes after.
• TestGlobToRegexpConcurrent — 64 goroutines with distinct patterns force concurrent cache writes; fails -race without the mutex (verified by reverting), passes with it.
• make preflight clean (build, gofmt, vet, test, -race).

Review

• Correctness (ruthless-reviewer): PROMOTE — boundary logic verified for /dev/null, 2>/dev/null, /Users/dev/x, /usr/dev/null, start/end-of-line; RWMutex race-free; shared guards slice is read-only.
• Security (security-reviewer): PASS — attacked the suppression with the machine user set to each dangerous system-dir name (incl. root); no false negative that ships a real leak. /root/secret still hard-fails via home_path_self; secrets are matched by a separate pattern set, unaffected.

Scope split (aggregate gate follow-ups)

Even with iss-31's three instances resolved, abcd launch --dry-run is not fully green on this repo — two out-of-scope blockers, filed separately:

• iss-77 — the payload also omits agents/ and hooks/ (auto-discovered plugin surfaces); deciding the public includes set is a maintainer/design call.
• iss-78 — .abcd/config/version-location.json is absent (the un-self-installed source-repo state), so lockstep + retention refuse.

Branches from main (independent of #41/#42). Do not merge / no auto-merge — maintainer merges fix: PRs.

Assisted-by: Claude:claude-opus-4-8