feat: harden crew account routing and Claude model enforcement

[ruby-dlee]

What Changed

• Restrict direct crew routing to enabled worker profiles in declared Agent Fleet pools, with trusted Claude approval-marker validation and an explicit last-resort pool.
• Add serialized account rotation for Claude candidates, Codex quota ties, and Codex fallback when quota signals are unavailable.
• Enforce the claude-opus-5 model anchor for Claude crews and scouts, propagate its configuration to secondmates, and expand routing/model regression coverage and documentation.

Risk Assessment

✅ Low: The cumulative change is well-bounded, and the descendant fixes now enforce trusted executable resolution, descriptor-bound marker ancestry, and explicit portable openat setup failure without introducing another material source risk.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 2 runs (4h57m50s)

Pipeline

Updates from git push no-mistakes

⏭️ **intent** - skipped

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed (3) ✅

• 🚨 bin/fm-account-directory.sh:168 - The new production selector executes ~/.local/bin/agent-fleet after checking only that it is a regular executable. Unlike the existing account-routing path, it does not resolve and validate the executable's ownership or writable path ancestors. A group/world-writable ancestor could therefore allow another local user to replace this control-plane binary and gain code execution during account selection. Reuse fm_account_fleet_bin or apply its physical-path, ownership, and ancestor-permission validation before execution.

🔧 Fix: Harden Agent Fleet and approval marker path trust
1 error still open:

• 🚨 bin/fm-account-directory.sh:412 - The Firstmate-directed parent-component contract is not fully enforced: each directory is opened independently by absolute pathname, its descriptor is closed, and the child is then reopened by pathname. A parent can be replaced between those operations, so the validated descriptors do not prove that the marker belongs to the validated account-home chain. Walk the hierarchy with openat/directory-relative opens while retaining parent descriptors, and open the marker relative to the validated quota-axi descriptor.

🔧 Fix: Bind approval validation to retained parent descriptors
1 warning still open:

• ⚠️ bin/fm-account-directory.sh:408 - The descriptor traversal hard-codes openat syscall numbers for only Darwin, Linux x86_64, and Linux arm64. The project advertises Linux generally, so routed Claude selection now silently rejects every account on other Linux architectures (for example ppc64le or riscv64) at defined($openat_number). Resolve the syscall through a platform-supported binding/header or explicitly gate and diagnose unsupported platforms instead of making accounts appear invalid.

🔧 Fix: Resolve openat portably with explicit unsupported diagnostics
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

🔧 Fix: Align Claude dispatch tests with Opus enforcement
1 error still open:

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.