feat: require backlog rows before new task spawns

[ruby-dlee]

Intent

Make filing a backlog row before dispatch a structural fail-closed mechanism in firstmate. A genuinely new ship or scout spawn must refuse before endpoint creation unless its ID is in the active home's In flight or Queued backlog, reading through the configured tasks-axi backend with an explicit HOME-scoped backlog file and falling back to manual section parsing when configured or unavailable. Secondmates, account recovery paths, and relaunches with existing metadata must remain exempt; batch dispatch must check each pair and continue after one refusal; the refusal must print the exact tasks-axi add repair command. Do not add a reasonless opt-out: permit only a small closed set of sanctioned exemption categories and record the chosen category in metadata. Resolve the AGENTS.md versus operating-fundamentals ordering contradiction so both say the row precedes endpoint creation. Add regression coverage for all of these paths. The existing fm-account-routing.test.sh session-sync race failure is a documented clean-main failure outside this change and must not be fixed or mistaken for a regression.

What Changed

• Require new ship and scout tasks to have an active-home In flight or Queued backlog row before endpoint creation, using tasks-axi with a manual parsing fallback.
• Preserve secondmate, account-recovery, and existing-metadata relaunch paths while restricting new-task exemptions to recorded, sanctioned categories and checking every batch entry independently.
• Align dispatch documentation with backlog-first ordering and add regression coverage for enforcement, repair guidance, exemptions, backend selection, and batch behavior.

Risk Assessment

✅ Low: The fix-round adds successful rowless coverage for resume, continuation, ordinary existing-metadata relaunch, and retains direct-account-recovery and secondmate coverage; the complete change now conforms to the stated intent without material source risks found.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 2 runs (3h48m55s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 tests/fm-spawn-backlog.test.sh:265 - Required regression coverage is incomplete: the intent requires account recovery paths and relaunches with existing metadata to remain exempt, but this suite explicitly verifies only direct-account recovery. Legacy --resume-account/--continue-account and ordinary existing-metadata relaunches are not exercised without a backlog row; existing fixtures were instead given rows, so regressions in those exemptions could pass unnoticed. Add rowless cases for each exempt path.

🔧 Fix: Cover rowless spawn exemption paths
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

🔧 Fix: Classify failures as unrelated lifecycle environment issues
1 error still open:

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.