Ponytail: the migrated-composer comment blocks restate the spike, and the queue spike ships an unrun download path #759

Two findings from /ponytail-review on the v0.71.1 release payload. Neither is a correctness bug; both are deliberately not fixed in v0.71.1, because comment churn at tag time is how a mistake gets in. Filing so they are tracked rather than dropped.

1. The same narrative now lives in six places (~23 lines)

src/gflow_cli/api/transports/migrated_composer.py: 81 of 233 added lines this release are # comments (35%), and the agent-mode / upload-consent story is now told in six places — the AGENT_MODE_CHIP constant block (17 lines), the upload-guard block (18 lines), the spike doc, CHANGELOG.md, KNOWN_ISSUES.md and docs/PROJECT_STATUS.md.

This is finding 13 of #752 — "the same measurement narrative is written out five times… the duplication-drifts failure AGENTS.md warns about" — re-introduced by me in the commit that fixed it. The rule that finding produced is the right one: the constant needs the selector rationale plus a spike pointer; the history belongs in the spike alone.

Concretely: keep why this selector and why count-not-match in the code, move what was measured on which account to the spike each block already links.

2. spike_migrated_queue_read.py ships a download path nothing has run (~20 lines)

--save-media / --save-to (L86-87, 125-139, 155-156, 159) fetch a signed CDN URL and write an mp4. Never exercised in any run, referenced by no doc or ledger, and it owns both of the script's only non-zero exits for a capability nobody used.

The counter-argument is real: #741 explicitly wants "a retry-safe way to recover a run whose CLI invocation timed out", and this is that. So the options are run it once ($0 — the queue reader already surfaces done records with signed URLs, so downloading one costs nothing) or cut it. Shipping it unrun is the one option to reject, because an untested recovery path is worse than no recovery path — it will be reached for in exactly the situation where it must not fail.

net: -48 lines possible if both are taken and the download path is cut rather than exercised.

Not a finding

AgentModeExit is a one-use Literal alias, which normally reads as YAGNI — but it carries the #: doc explaining why blocked ≠ clicked, and inlining it would cost that. Keep.

Refs #752, #741, #719