wave-guard: match workers by argv shape; accept wave 8; record HAZARD #10

The guard's `pgrep -f 'run-task\.sh'` matched the orchestrator's own stale
launching shell, whose command line contains that text, so it kept the sprite
awake for 17 hours after J-crashsafe finished. workers_running() now requires
argv[1] to be the runner script and argv[2] to be one of this wave's tasks.

Also commits the wave-7 sid/sentinel that were never added.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AQb3d68LqWD4EdND3C8jkD

tasks/wave-guard.sh

@@ -57,7 +57,20 @@ else
 fi
 last_renew=$(date +%s)
 
-while pgrep -f 'run-task\.sh|run-resume\.sh' >/dev/null; do
+# WAVE 8 POST-MORTEM — why this is not `pgrep -f 'run-task\.sh'`:
+# pgrep -f matches ANY command line containing that text. The orchestrator's own
+# launching `bash -c '... setsid nohup ./tasks/run-task.sh ...'` stayed alive after
+# the worker finished, so the guard saw "workers still running" for 17 hours and
+# held the sprite hot the whole time (HAZARD #6). Match on argv SHAPE instead: the
+# interpreter is bash, argv[1] IS the runner script, and argv[2] is one of THIS
+# wave's task names. A `bash -c` has argv[1] = "-c" and can never match.
+workers_running() {
+  ps -eo args= | awk -v tasks=" ${TASKS[*]} " '
+    $1 ~ /(^|\/)bash$/ && $2 ~ /(^|\/)run-(task|resume)\.sh$/ && index(tasks, " " $3 " ") { found=1 }
+    END { exit !found }'
+}
+
+while workers_running; do
   sleep "$POLL"
   now=$(date +%s)
   if [ $(( now - last_renew )) -ge "$RENEW" ]; then