fix(git-tools): refuse no-ci assertion without an attributable identity

The --no-ci-expected admin-success path accepted an asserted-by=unknown
pass when MOSAIC_GIT_IDENTITY was unset or empty, so the queue-clear
assertion and its NO_CI_ASSERTED audit record named no one. Refuse such
callers with a distinct ASSERTION_UNATTRIBUTABLE outcome (exit 78, audit
recorded) before queue-clear and before the permission lookup, so an
unattributable caller never triggers that network call. Document exit 78
in the usage text and the tools reference; pin the path with a
regression case (admin stub + env -u MOSAIC_GIT_IDENTITY).

packages/mosaic/framework/tools/git/test-ci-queue-wait-no-ci-expected.sh

@@ -19,6 +19,9 @@
 #       unchanged; no admin consultation on push.
 #   (g) flag + admin lookup unreachable      -> CANNOT_ASSERT hold (75),
 #       not a silent pass and not a refusal.
+#   (h) flag + admin stub + NO MOSAIC_GIT_IDENTITY -> refusal BEFORE
+#       queue-clear and BEFORE the admin lookup: exit 78, no queue-clear
+#       line, an ASSERTION_UNATTRIBUTABLE JSONL record, no repos/ call.
 
 set -u
 
@@ -111,6 +114,25 @@ run_guard() {
     )
 }
 
+# The suite exports test-identity globally, so the unattributable-caller
+# case must strip it from the child environment at invocation with env -u,
+# not rely on the export order.
+run_guard_no_identity() {
+    local name="$1"; shift
+    (
+        cd "$REPO_DIR" || exit
+        export PATH="$STUB_DIR:$PATH"
+        export MOSAIC_CREDENTIALS_FILE="$WORK_DIR/no-credentials.json"
+        export MOSAIC_CI_QUEUE_AUDIT_LOG="$WORK_DIR/audit-$name.jsonl"
+        export MOSAIC_STUB_URL_LOG="$URL_LOG"
+        export GITEA_TOKEN="stub-token"
+        export GITEA_URL="https://git.example.test"
+        export MOSAIC_GIT_IDENTITY="test-identity"
+        env -u MOSAIC_GIT_IDENTITY \
+            "$SCRIPT_DIR/ci-queue-wait.sh" -B main -t 3 -i 1 "$@"
+    )
+}
+
 expect_rc() {
     local name="$1" want="$2" got="$3"
     if [[ "$want" == "not3" ]]; then
@@ -272,6 +294,27 @@ if ! grep -q '"outcome":"CANNOT_ASSERT"' "$WORK_DIR/audit-g.jsonl" 2>/dev/null;
     failures=$((failures + 1))
 fi
 
+# (h) flag + admin stub + no asserting identity -> refusal before queue-clear
+# and before the admin lookup: rc 78, no queue-clear line, an
+# ASSERTION_UNATTRIBUTABLE JSONL record, and zero repos/ network calls.
+: > "$URL_LOG"
+set +e
+out_h=$(MOSAIC_STUB_STATUS_MODE=no-status MOSAIC_STUB_ADMIN_MODE=admin run_guard_no_identity h --purpose merge --no-ci-expected 2>&1)
+rc_h=$?
+set -u
+if expect_rc h 78 "$rc_h"; then
+    expect_text h "ASSERTION_UNATTRIBUTABLE state=no-status purpose=merge asserted-by=unknown reason=no-ci-expected branch=main" "$out_h"
+    expect_text h "queue-clear" "$out_h" absent
+    if ! grep -q '"outcome":"ASSERTION_UNATTRIBUTABLE"' "$WORK_DIR/audit-h.jsonl" 2>/dev/null; then
+        echo "FAIL h: expected an ASSERTION_UNATTRIBUTABLE JSONL audit record" >&2
+        failures=$((failures + 1))
+    fi
+fi
+if repo_root_fetched; then
+    echo "FAIL h: an unattributable caller must not trigger the permission lookup" >&2
+    failures=$((failures + 1))
+fi
+
 if [[ "$failures" -ne 0 ]]; then
     echo "ci-queue-wait no-ci-expected regression failed ($failures assertions)" >&2
     exit 1