fix: accept landed tasks after default history rewrites

[ruby-dlee]

Intent

Fix Firstmate teardown falsely refusing a landed task branch when main was history-rewritten after branch creation. Preserve the destructive-safety contract: accept only when the task's net changes are proven present in the authoritative up-to-date default branch, while retaining worktrees for unlanded additions, unlanded deletions, non-default branch baselines, missing reflog/fork-point evidence, or any inconclusive proof. Verify the real teardown lifecycle, including endpoint quiescence and task-metadata removal. Keep the landed-work contract owned by bin/fm-teardown.sh and tests colocated in tests/fm-teardown.test.sh. Ship through a PR without merging it; the PR must state that this Firstmate CLI change has no web-app, API, realtime, or manual operator deploy lane.

What Changed

• Proves landed task changes against rewritten default-branch history using branch-creation and default-branch reflog evidence, while failing closed when the baseline or landing proof is inconclusive.
• Expands teardown lifecycle coverage for landed changes, unlanded additions and deletions, non-default baselines, endpoint quiescence, and metadata removal; also stabilizes watcher lock-takeover fixtures.
• This Firstmate CLI change has no web-app, API, realtime, or manual operator deploy lane.

Risk Assessment

✅ Low: The change is narrowly scoped, fails closed when creation-base evidence is absent or inconclusive, protects additions and deletions, and verifies successful endpoint and metadata cleanup.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 3 runs (6h55m54s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

🔧 Fix: Repair teardown lifecycle test endpoint fixture
1 error still open:

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

🔧 Fix: Stabilize watcher lock takeover lifecycle fixture
1 error still open:

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.