fix: address review — terminal phase guard, explicit marker var, test coverage

- Guard against overwriting terminal phases (PHASE:done, PHASE:merged)
  in on-stop-failure.sh to prevent false failures from same-turn race
- Declare sf_phase_marker explicitly in StopFailure block instead of
  relying on phase_marker from PostToolUse block
- Add authentication_failed test (10c) and terminal phase guard tests
  (10g, 10h)
- Fix fragile nested command substitution in test 10f fail() message

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/agent-session.sh

@@ -130,7 +130,10 @@ create_agent_session() {
   if [ -n "$phase_file" ]; then
     local stop_failure_hook_script="${FACTORY_ROOT}/lib/hooks/on-stop-failure.sh"
     if [ -x "$stop_failure_hook_script" ]; then
-      local stop_failure_hook_cmd="${stop_failure_hook_script} ${phase_file} ${phase_marker}"
+      # phase_marker is defined in the PostToolUse block above; redeclare so
+      # this block is self-contained if that block is ever removed.
+      local sf_phase_marker="/tmp/phase-changed-${session}.marker"
+      local stop_failure_hook_cmd="${stop_failure_hook_script} ${phase_file} ${sf_phase_marker}"
       if [ -f "$settings" ]; then
         jq --arg cmd "$stop_failure_hook_cmd" '
           if (.hooks.StopFailure // [] | any(.[]; .hooks[]?.command == $cmd))