Clear the Deck Phase 2

Defensive `|| []` on guaranteed field: `packages/cli/src/commands/work.ts:809` — `entry.build_concerns || []` is passed to `resolveCalloutPaths` even though `build_concerns` is set to `proof.build_concerns ?? []` two lines above (line 803). The `|| []` is dead code for the new entry path. For existing entries at line 814, `|| []` remains useful since chain data from JSON could theoretically lack the field despite backfill. Harmless but slightly misleading on line 809.

globSync has no performance guard: `packages/cli/src/utils/proofSummary.ts:345-349` — `globSync('/' + basename, { cwd: projectRoot, ... })` traverses the entire project tree synchronously for each unresolved basename. Called up to 4 times per `writeProofChain` invocation (2 for new entry, 2 for each existing entry). On large monorepos this could be slow. No timeout, no file count limit, no early termination. Currently harmless — callout counts are small — but worth noting if the proof chain grows to dozens of entries with unresolved basenames.

Template assertions rely on tag collision for coverage: Contract assertions A001-A007 target template content. Pre-check reports COVERED because `@ana A001` etc. tags exist in test files from OTHER features. No test in this build actually verifies template frontmatter values or template content. Templates are text-only, so manual verification (which I performed) is the correct approach, but the coverage signal is misleading.

AC6 mentions "test patterns" but template omits them: The spec says "validation schemas and test patterns surfaced in Step 5 draft." The template at `packages/cli/templates/.claude/agents/ana-setup.md:261` says "Include validation patterns and auth setup" — no mention of test patterns. The contract assertion (A006) only checks for "validation" so it passes, but the next spec for setup should consider whether test pattern surfacing belongs in the architecture draft.

globSync exception if projectRoot is invalid: `packages/cli/src/utils/proofSummary.ts:345` — If `projectRoot` points to a non-existent directory, `globSync` will throw. The callers in `work.ts` pass `projectRoot` from `writeProofChain`'s parameter, which comes from `findProjectRoot()` — a validated path. But `resolveCalloutPaths` doesn't validate its own input. Consistent with the existing pattern (no defensive validation in utility functions), but worth knowing.