dispatch-diagnose-mainlisted

# Dispatch: Diagnose Main Runs as its own `claude --bg` job (session name `diagnose-main`) spawned when the `main-health` sensor reads red — `origin/main` itself is failing CI, so no new work is safe to start. The diagnosis is recorded as a find-or-create graph tactic node `tactic-main-red-<shortsha>` (one per red episode, keyed on the broken HEAD's short SHA). That node `serves` and `validates` `strategy-main-health`, so it inherits the strategy's rank and becomes a durable, dispatchable fix item that outlives this job's transcript. It is born a draft (`phase: null`) — a diagnosis, not yet a plan; a later `/align-tactics tactic-main-red-<shortsha>` finalizes it into an actual fix plan. This job holds no dispatch lock. The skill does **not** run the sweep, create a worktree, branch, PR, or invoke any phase skill, and it never files or edits a GitHub issue. Takes `<sha>` as its single argument — the broken `origin/main` HEAD commit. Run `gh` commands with `dangerouslyDisableSandbox: true` — see `.claude/rules/sandbox.md`. The graph-write step's `write-node.ts` / `dump-node.ts` fences and its `graph-commit` call (Step 3) need it too — but **not** for the npm-cache reason this note used to give. That rationale was measured and refuted on this host and no longer appears in `.claude/rules/sandbox.md`, and `node --import tsx/esm` needs no override of its own. The still-valid reasons are two: - Every Step 3 fence reads or writes under `$CLAUDE_JOB_DIR/tmp`, a path outside `.cl