docs: accept wave 5; record HAZARD #8 (guard can die without its sentinel)

The wave-guard was killed after its 11:13 renewal and never wrote
logs/WAVE5-DONE, despite the worker succeeding at 11:21. That makes this
file's own first-command heuristic actively misleading — "no sentinel +
no processes -> workers were KILLED" would have thrown away a completed,
verified wave. Recorded the reliable signals instead: the size of
logs/<name>.json and the tail of logs/<name>.state.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

logs/WAVE5-DONE

@@ -0,0 +1,22 @@
+=== WAVE5-DONE written BY HAND by the orchestrator, 2026-09-09 ===
+NOT written by tasks/wave-guard.sh. The guard renewed its lease at 11:13, the
+worker reported SUCCESS at 11:21, and the guard should have noticed within 30s
+and written this file. It never did, and it left no "guard exiting" line either,
+so it was killed outright rather than exiting through its TERM/INT trap. The
+lease then expired on its own at ~12:13.
+
+READ THIS BEFORE TRUSTING THE FIRST-COMMAND HEURISTIC AT THE TOP OF HANDOFF.md:
+"no sentinel + pgrep 0 -> workers were KILLED" would have been WRONG here. The
+worker finished successfully; only the guard died. The reliable signal is the
+size of logs/<name>.json (5695 bytes here — a killed worker leaves 0) plus the
+tail of logs/<name>.state (which says SUCCESS).
+
+G-diagnostics: SUCCESS after 2 attempts, 1 quota wait. cost=$0.28, turns=6.
+Independently re-verified by the orchestrator:
+  ./tasks/gw assembleDebug          exit 0
+  ./tasks/gw testDebugUnitTest      exit 0 - 138 tests, 1 skipped, 0 failures (was 107)
+  ./tasks/gw verifyPaparazziDebug   exit 0
+  ./tasks/gw assembleRelease        exit 0 - 41,793,760 bytes, V2 signer CN=Bookshelf
+  boundary check                    clean - no build files, no forbidden packages
+  grep "always 'false'"             0 hits on touched files
+Accepted and committed as 93f972b.