[TheGreatAxios]

Hidden-shell decline fingerprint: denialFingerprint(rawCall, cwd) = stableRequestId(callForIdentity(rawCall), cwd, ...), so an operator decline suppresses the coerced run_shell retry with the identical reason on the middleware, decide, and reactor paths.

• denialFingerprint derives from callForIdentity instead of name-only canonicalization; decide() fingerprints the raw call; evaluate() passes the raw call with the deny/timeout-never-cache guard unchanged; resolveSuspended rebuilds its key through the same helper (inline {id:""} form deleted).
• No tool-aliases change: looksLikeCodexShellArgs already ignores native cwd/timeout, so coercion is idempotent on coerced run_shell (asserted in tests).
• Audit: stableRequestId has no other callers; remaining canonicalToolName/withCanonicalToolName uses (grant minting, authorize identity cache, classify, grants) are policy/grant concerns, not denial keys — left intact.
• Tests extend the hiddenShellArgv harness: middleware argv decline suppresses coerced + raw retries, workdir-to-cwd variant, reactor authorizeCall+resolveSuspended path with middleware-identical reason, plain run_shell regression, coercion idempotency.

Note: repo typecheck/build currently fail on origin/main from a stale oauth-core pin (callbackTargetFor missing in the installed github-version package); unrelated to this change.

Fixes CL-9341

[linear-code]

CL-9341