wave-guard: match workers by argv shape; accept wave 8; record HAZARD #10

The guard's `pgrep -f 'run-task\.sh'` matched the orchestrator's own stale
launching shell, whose command line contains that text, so it kept the sprite
awake for 17 hours after J-crashsafe finished. workers_running() now requires
argv[1] to be the runner script and argv[2] to be one of this wave's tasks.

Also commits the wave-7 sid/sentinel that were never added.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AQb3d68LqWD4EdND3C8jkD

logs/I-gbkey.sid

@@ -0,0 +1 @@
+7f72ab05-2e62-49a0-858f-638646c68767

logs/WAVE7-DONE

@@ -0,0 +1,10 @@
+=== WAVE7-DONE written 2026-09-11T23:25:00+00:00 ===
+Workers finished. The orchestrator was NOT necessarily alive for this.
+
+--- I-gbkey ---
+[2026-09-11T23:23:43+00:00] I-gbkey: QUOTA hit (wait #1). sleeping 600s then probing again.
+cost=$1.5929609999999998 turns=51
+
+NEXT: orchestrator must independently verify before accepting:
+  cd ~/bookshelf && ./tasks/gw assembleDebug && ./tasks/gw testDebugUnitTest
+  git status --porcelain   # boundary check: who touched what