fix(wake): #914 digest renderer — WAKE_AGENT-prefixed ack line + digest-class locator threading

(a) the embedded ack copy-run line (digest.sh -> ack.sh embed) now bakes an
    explicit WAKE_AGENT=<render-time-agent> prefix (scrubbed via _scrub_inline,
    shell-quoted via printf %q), so an env-less copy-run resolves to the
    correct per-agent namespace instead of silently falling back to 'default'.

(b) _locator_line now also recognizes the locator vocabulary detector.sh (A1)
    actually emits for a digest-class entry (kind/id/observed_hash/remote/path
    /branches, not repo/issue/sha/file), so a digest-class ORIENTATION pointer
    carries a usable (soft) locator instead of rendering empty. Display-only:
    _has_hard_locator and the ACTIONABLE-tier hard-locator FAIL-LOUD (exit 4)
    are unchanged.

RED-FIRST: new D5/D6 groups added to test-wake-digest-hmac.sh, verified RED
against unmodified digest.sh/ack.sh and GREEN after the fix (stash/pop
diffed). H1/H2 (openssl-dependent) are now individually SKIPped instead of
short-circuiting the whole file, so D1-D6 (including the new tests) still run
and pass when openssl is masked from PATH.

Touches only digest.sh + ack.sh + their test harness + the wake manifest
version bump; store.sh/detector.sh/reconcile.sh untouched (avoids collision
with the concurrent #908 work).

Closes #914
Part of #892

packages/mosaic/framework/tools/wake/ack.sh

@@ -54,8 +54,23 @@ Commands:
                                          Local-write only; a background sync
                                          ships it (never blocks on network).
                                          --no-sync suppresses the background ship.
-  embed --upto N [--wake-id ID]          Print the copy-run ack line to EMBED in
+  embed --upto N [--wake-id ID] [--agent A]
+                                         Print the copy-run ack line to EMBED in
                                          a digest (does not perform the ack).
+                                         --agent bakes an EXPLICIT
+                                         `WAKE_AGENT=A ` prefix onto the emitted
+                                         line (render-time namespace), so an
+                                         ENV-LESS copy-run still resolves to the
+                                         correct per-agent queue instead of
+                                         silently falling back to `default`
+                                         (#914). The value is shell-quoted
+                                         (`printf %q`) so it can never inject
+                                         additional shell syntax when the line
+                                         is later copy-run; the caller is
+                                         expected to have already scrubbed it
+                                         (control/ANSI/secrets) the same way
+                                         any other inlined digest value is
+                                         scrubbed.
   status                                 Print ledger tail + cursor state.
 
 Environment:
@@ -210,7 +225,7 @@ cmd_consumed() {
 }
 
 cmd_embed() {
-  local upto='' wake_id=''
+  local upto='' wake_id='' agent=''
   while [ $# -gt 0 ]; do
     case "$1" in
     --upto)
@@ -221,6 +236,10 @@ cmd_embed() {
       wake_id="${2:-}"
       shift 2
       ;;
+    --agent)
+      agent="${2:-}"
+      shift 2
+      ;;
     *)
       echo "ack.sh embed: unknown option '$1'" >&2
       exit 2
@@ -236,10 +255,26 @@ cmd_embed() {
   # The one copy-run line a digest embeds. WAKE_ACK_CLI lets an installer point
   # it at the deployed path; default is this script's resolved path.
   local cli="${WAKE_ACK_CLI:-$SCRIPT_DIR/ack.sh}"
+  # #914a: bake the render-time agent in as an EXPLICIT `WAKE_AGENT=<agent> `
+  # prefix, so an ENV-LESS copy-run resolves to the SAME per-agent namespace
+  # the digest was rendered for, instead of silently falling back to `default`
+  # (wake_state_dir() resolves purely from ${WAKE_AGENT:-default} at RUN time,
+  # which — absent this prefix — has no relation to the agent the digest was
+  # rendered for). `printf %q` shell-quotes the value so it is embedded as one
+  # opaque token and can never inject additional shell syntax into the line
+  # when it is later copy-run, even if the (caller-scrubbed) agent value still
+  # carries shell metacharacters. This is purely additive: no --agent => the
+  # line is byte-identical to before (existing direct callers unaffected).
+  local prefix=''
+  if [ -n "$agent" ]; then
+    local agent_q
+    printf -v agent_q '%q' "$agent"
+    prefix="WAKE_AGENT=${agent_q} "
+  fi
   if [ -n "$wake_id" ]; then
-    printf '%s consumed --upto %s --wake-id %s\n' "$cli" "$upto" "$wake_id"
+    printf '%s%s consumed --upto %s --wake-id %s\n' "$prefix" "$cli" "$upto" "$wake_id"
   else
-    printf '%s consumed --upto %s\n' "$cli" "$upto"
+    printf '%s%s consumed --upto %s\n' "$prefix" "$cli" "$upto"
   fi
 }