dispatch.py roster policy regression: explicit reviewers dropped, claude injected per-subagent dispatch

[jimstratus]

File: scripts/dispatch.py:99 / scripts/_common.py:resolve_roster (introduced by #4's fix on the PR #12 branch)

Wiring resolve_roster into dispatch.py applied profile-grade policy to explicit rosters:

1. Explicitly-named disabled reviewers are hard-dropped — dispatch.py --roster gemini exits 1 "empty after policy filtering" with no force option, while benchmark.py --roster gemini deliberately honors explicit naming as intent. The documented CLAUDE.md roster (glm-5.1,minimax-m2.7,gemini,codex) silently loses gemini.
2. host_rules add: [claude] injects claude into explicit rosters — under SKILL.md step 6a (one dispatch.py --roster <single-name> per subagent), a K-reviewer review on a codex/gemini/opencode host dispatches claude K times concurrently, racing on reviews/claude.json, never cost-estimated.
3. tier/privacy gates now filter dispatch but SKILL.md recipes don't thread --allow-free/--allow-logging — an approved free-tier reviewer passes roster resolution and estimate, then each subagent dispatch drops it.
4. Dropped reviewers leave no trace in run artifacts (stderr only) — dispatch_summary.json should record drops.

Fix: add explicit semantics to resolve_roster (explicit names exempt from disabled/custom_only; host_rules skip still applies, add does not), record drops in dispatch_summary.json, and use resolve_roster from benchmark.py too so all entry points share one policy.

Found by /code-review round 2 on the PR #12 diff (4 of 7 finder angles, CONFIRMED).