fix: address review — terminal phase guard, explicit marker var, test coverage

- Guard against overwriting terminal phases (PHASE:done, PHASE:merged)
  in on-stop-failure.sh to prevent false failures from same-turn race
- Declare sf_phase_marker explicitly in StopFailure block instead of
  relying on phase_marker from PostToolUse block
- Add authentication_failed test (10c) and terminal phase guard tests
  (10g, 10h)
- Fix fragile nested command substitution in test 10f fail() message

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/hooks/on-stop-failure.sh

@@ -25,6 +25,14 @@ reason=$(printf '%s' "$input" | jq -r '
 ' 2>/dev/null)
 [ -z "$reason" ] && reason="unknown"
 
+# Guard: do not overwrite a terminal phase. If Claude wrote PHASE:done via a
+# tool call and then hit a rate limit while generating the rest of its response,
+# the PostToolUse hook already recorded the correct terminal phase.
+existing=$(head -1 "$phase_file" 2>/dev/null | tr -d '[:space:]')
+case "$existing" in
+  PHASE:done|PHASE:merged) exit 0 ;;
+esac
+
 # Write phase file immediately — orchestrator reads first line as phase sentinel
 printf 'PHASE:failed\nReason: api_error: %s\n' "$reason" > "$phase_file"