fix(claude-p): salvage dominant-string TOOL_CALLS defects; stop_reason gates repairs

One raw interior double quote in a 60KB generate_docx markdown string
discarded a completed DPA draft (2026-08-06) and bought a corrective
regeneration ~30% shorter. parseReply now recovers that class safely:

- jsonrepair keeps first authority (it preserves all fields for small
  structural slips), but for large payloads its result must preserve
  the raw key inventory (one-sided) - a repair that swallowed a field
  or call is worse than no repair.
- Structural salvage when jsonrepair fails: anchor the dominant
  string's closing quote at the envelope tail, re-derive the logical
  string from the model's own bytes (valid escapes decode, defects
  pass through verbatim, nothing invented), re-escape strictly, accept
  only candidates that re-parse strictly, satisfy the calls shape, and
  preserve the key inventory. Latest surviving opening wins; 64-candidate cap.
- Truncation is decided by the transport, not tail bytes: stop_reason
  captured from assistant/message_delta events on both spawn paths;
  stop_reason=max_tokens blocks BOTH repair paths so a partial draft
  can never pass as complete.
- Raw replies preserved to tmpdir on both salvage and parse failure.

Adversarially reviewed (opus subagent): the initial version had four
blocking findings (sibling-field/call absorption, jsonrepair
preemption, tail-byte truncation guard fakeable and over-refusing) -
all closed. Reviewer probe matrix 0/23 regressed vs pre-change
behavior; the real preserved DPA reply recovers its full 59,155-char
draft byte-exact. Residual, documented: odd dangling-backslash content
takes jsonrepair's normalization exactly as on main, and truncation
gating needs a visible stop_reason.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pfUVhNFTRvhYGXBwoKNj6