inspect: address review verdict (judge alias, prompt injection, token attribution, picker model, scratch files)

• Judge agent resolution: profileJudge now resolves a judge that names a worker alias (e.g. 'claude-opus' for {agent: claude-code, model: opus}) to the underlying agent the synthesis provider can launch, inheriting the worker's model. Previously an alias would reach agent.Get and fail.
• Prompt injection: the judge prompt now fences each inspector report between BEGIN/END markers and instructs the judge to treat their contents as untrusted data, never as instructions.
• Token attribution: extracted the two-pass session matcher (matchSessionsToRuns) and use it in token hydration too, not just the local manifest, so mixed default/explicit-model profiles attribute sessions consistently.
• Advanced --edit picker no longer prompts for a per-inspector model (matching guided setup); any scripted model is preserved.
• Removed the temporary root prompt-*.md scratch files.
• Documented the Process.Wait contract: no goroutines may outlive Wait (the orchestrator releases the run context right after).

Tests: judge alias resolution, reviewWorkerLabel (incl. model-only), inspector-report defanging.

Note: SummaryTimeoutSeconds (explain, 5m) is unrelated to the inspector timeout (10m) — different features, not a conflict.