process-gap(story-writer+adversary): stale story-id pointers in inline code comments survive all spec gates

## Observation

When the story-writer is asked to create a follow-up story for a deferral
flagged during adversarial review, there is a window between (a) the
implementer writing the DEFERRED inline code comments that name the
follow-up story id and (b) the story-writer actually minting the story
file with its canonical id. If the deferral is registered while the
follow-up is still "next available id" and then the story-writer picks
a different next id (e.g., because an intervening story was created), the
inline comments become **stale story-id pointers**.

Adversarial review found this pattern in one Wave-2 story:

- Implementer wrote `DEFERRED to STORY-X.YY.005` in 4 inline comment sites
(audio_manager.gd) and 1 `push_warning` runtime string.
- Story-writer subsequently minted the follow-up as `STORY-X.YY.006`
because a sibling team had already taken `.005`.
- Story body Deferred-Scope table was correctly updated; inline comments
were not.
- A future implementer of `STORY-X.YY.006` reading the comments would
arrive at `STORY-X.YY.005` — a completely different story
("Missing VO File — Subtitle Fallback") with nothing to do with the
deferred work. Adversarial Pass-10 caught it; production wasn't yet
affected.

## Proposed framework remediation

1. **Forward-only story-id allocation**: story-writer reserves the
follow-up id atomically with the deferral note. The implementer writes
`DEFERRED ` and the token resolves to the final id
when the story is minted. (Heavier machinery.)

2. **Lighter remediation — cross-reference lint**: a deterministic CI
lint that:
- Greps the implementation tree for `STORY-X.YY.NNN` mentions inside
comments and warnings.
- For each match, verifies the referenced story id exists AND its
subject contains a domain-keyword overlap with the comment context
(e.g., the inline comment talks about "audio threshold" — referenced
story subject should contain "audio" or "threshold" or
equivalent-domain wording).
- Fails the lint if a referenced story id doesn't exist OR is a
subject-mismatch.

3. **Adversarial-pass hint**: add a mandatory probe to adversarial review
prompts: "grep for inline `STORY-X.YY.NNN` references and validate each
resolves to an existing story whose subject overlaps semantically".
Pass-10 caught this organically because the adversary did this probe;
making it mandatory across all passes would catch earlier.

## Distinct from existing upstreams

- Distinct from #327 (AC-anchor integrity): #327 is about AC text
citing fabricated/mis-anchored BC anchors. This is about inline-comment
story-id pointers, a different vector.
- Distinct from #339 (rename residuals): not a rename event.
- Distinct from #288 (stub-time citation crossing namespace): #288 is
about stale `STUB —` docstrings on filled-in functions. This is about
story-id pointers being valid-looking but pointing to the wrong story.

## Severity

MEDIUM. A misled implementer of the follow-up story would apply work to
the wrong-domain story or simply waste time discovering the misdirection.
Real instances are rare-but-present (1 in this session of 4 parallel
stories).

## Evidence

Same session as the Godot-cache and rebase-drop reports. Adversarial
Pass-10 finding F-P10-001 specifically; fix landed in the implementer's
next burst as a 2-site comment-id swap.