Pass Claude prompts to lane D on stdin, not as an argument #210

Follow-up from #201 part 1 (PR #208).

Problem. AGENTS.md says: "Pass text whose size follows user or agent input to a subprocess on stdin, never as an argument." Lane D's Claude command (agents/policy.ts, createClaudeCommand) passes the planning prompt, and since #201 the review prompt, as the last argument (--, prompt).

Why it does not fail today. Each prompt is bounded by the shared model budget MAX_PLANNING_INPUT_BYTES (64 KiB, less the schema). That is under Linux's 128 KiB limit for one argument, and a test checks it. NUL is refused before the command is built.

Risk. A later change that raises the budget, or adds a phase without the bound, would make valid input fail when the process starts instead of failing with the budget's error.

Fix. Pass the prompt on stdin for every Claude phase. Then re-record the planning and review recordings: their command hash covers the argv.

Done when: no Claude command carries its prompt as an argument, and a test fails if one does.