feat(sentry): wire the roam writers and wrap-up guard for sentry

Phase 3 of the sentry supervisor: reconcile the existing roam writers and wrap-up so sentry's locks actually guard something, and its shutdown has one enforced entry point.

The roam-write lock only helps if every roam writer takes it, so both writers now do. knowledge-base.md's write recipe and inbox.org core §5 acquire the roam-write lock around their edit and trigger roam-sync instead of committing themselves. That closes a gap the one-git-owner rule already implied but the KB recipe still violated: the recipe told agents to run git add -A && commit && push against a tree that's chronically dirty from live captures, which could sweep an in-flight capture into a stray commit. roam-sync stays the roam repo's only committer. Agents edit-plus-trigger under the lock, and roam-sync.sh's header now states that contract instead of the old "agents commit inline" note.

Both writers degrade as the spec settled: an absent agent-lock proceeds unlocked (today's behavior), and only a present helper reporting the lock busy after its bounded wait defers or surfaces.

wrap-it-up.org gains a Step 0 that refuses while sentry is live. It checks the single-runner lock and points at "stop sentry" rather than archiving the anchor and tearing down the buffer under a still-firing loop. Both files derive the lock name the same way (sentry-<repo-basename>), so the guard and the engine agree. triage-intake.org notes that it also runs as sentry's triage pass under the no-approvals contract, with its trigger phrases unchanged.

1 files changed, 7 insertions, 2 deletions

diff --git a/scripts/roam-sync.sh b/scripts/roam-sync.sh
index 55422ec..ef43c8f 100755
--- a/scripts/roam-sync.sh
+++ b/scripts/roam-sync.sh
@@ -3,8 +3,13 @@
 #
 # Commit any local changes, rebase onto the remote, push. Run by the
 # roam-sync systemd user timer (scripts/systemd/) every 15 minutes so
-# Craig's hand edits travel without a manual git step. Agents don't need
-# this — they pull/commit/push inline per claude-rules/knowledge-base.md.
+# Craig's hand edits travel without a manual git step. This script is the
+# roam repo's only committer (the 2026-06-24 one-git-owner rule): the tree
+# is chronically dirty from live captures, so a second committer risks
+# sweeping an in-flight capture into a stray commit. Agents edit the working
+# tree under the roam-write lock, then trigger this unit (systemctl --user
+# start roam-sync.service) instead of committing themselves — see
+# claude-rules/knowledge-base.md and the inbox workflow's roam mode.
 #
 # On a rebase conflict: abort the rebase (never leave the repo mid-rebase
 # for a timer to mangle), keep the local commit, exit 1 so the failure is