fix(kvb-org-queue): book light jobs by their own footprint

Light single-file runs booked about 17 % RAM and 5 GB learned from heavy runs under a polluted signature. Each entry now stores its aliases, freezes its footprint at grant and learns per signature and kind; heavy kinds book at least the old pooled share, and a job keeps its own learned disk need when the old pool is empty. Hooks take the payload cwd and fall back to the old rule when it is unknown or malformed. Six skill docs now agree on what self-admits. test_queue 70, test_watch 46 and test_operator 30 green with negative controls; two independent reviews.

🎯 Fix: 90 %
💥 Break: 5 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 86
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_watch.py

@@ -174,6 +174,18 @@ class TestWatchCommands(unittest.TestCase):
         self._stage("warn")
         self.assertEqual(self._run("block", stdin=self._bash("make compose-deploy")).returncode, 0)
 
+    def test_block_counts_discovered_files_in_the_payload_cwd_and_an_unusable_cwd_as_unknown(self):
+        self._stage("stop")
+        for name in ("tree/a/test_main.py", "tree/b/test_main.py"):
+            (self.base / name).parent.mkdir(parents=True, exist_ok=True)
+            (self.base / name).write_text("", encoding="utf-8")
+        command = {"command": "python3 -m unittest discover -s tree -p test_main.py"}
+        self.assertEqual(self._run("block", stdin=json.dumps({"tool_input": command, "cwd": str(self.base)})).returncode, 2)
+        for cwd in (str(self.base / "tree"), 5, ["/"], {"a": 1}, "tree", None):
+            with self.subTest(cwd=cwd):
+                blocked = self._run("block", stdin=json.dumps({"tool_input": command, "cwd": cwd}))
+                self.assertEqual((blocked.returncode, blocked.stderr), (0, ""))
+
     def test_block_heavy_jobs_while_a_mayday_holds_radio_silence(self):
         self._stage("ok")
         self.root.mkdir(exist_ok=True)