fleet: T110 rework - exact fleet/bin ownership, absolute fallback guard, mutation-controlled suite

B1 (rev-code-02): fleet/bin/** made keep-mode update prune existing estate
executables absent from the package source. Replaced with exact entries
(fleet/bin/mosaic, fleet/bin/test-mosaic-launcher.sh); parity spec gains a
dedicated ownership probe asserting the two shipped files are framework-owned
while seat-up.sh, launch-seat.sh and the directory itself stay operator-owned,
on both resolvers.

B2: a relative HOME bypassed the fallback guard (component probes were
absolute-prefixed, so a relative candidate walked nonexistent absolute paths
and a planted cwd-relative CLI executed). The untrusted fallback candidate is
now refused unless absolute, with parent-escape (..) components refused as
well; the symlink walk then applies.

B3: A6 planted the executable off the resolved candidate path, so a
guard-bypass mutant stayed green (nothing executable at the candidate). The
symlink now points at $PLANT/.npm-global so the candidate resolves exactly to
the planted binary, and the suite gains two mutation controls: a
guard-bypassed copy MUST execute both the absolute-symlink plant and the new
relative-HOME plant (sentinels asserted present), while the real launcher
refuses both (rc 127, diagnostics, sentinels absent).

Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-REWORK-M5N6.

packages/mosaic/src/framework/manifest-parity.spec.ts

@@ -148,6 +148,26 @@ describe.skipIf(!hasBash)('bash ↔ TS manifest parity (§6.1)', () => {
     const manifest = loadManifest(FRAMEWORK_ROOT);
     expect(bashSubtreeRoots().sort()).toEqual(frameworkSubtreeRoots(manifest).sort());
   });
+
+  it('fleet/bin ownership is exact and does not prune existing executables (T110 B1)', () => {
+    // fleet/bin carries estate executables this package does not ship. A
+    // subtree glob here would classify them framework-owned and keep-mode
+    // update would prune them. The manifest must own EXACTLY the two shipped
+    // launcher files and nothing else in fleet/bin, on BOTH resolvers.
+    const manifest = loadManifest(FRAMEWORK_ROOT);
+    const expected: Array<[string, string]> = [
+      ['fleet/bin/mosaic', 'framework'],
+      ['fleet/bin/test-mosaic-launcher.sh', 'framework'],
+      ['fleet/bin/seat-up.sh', 'operator'], // shipped-by-estate, unshipped here
+      ['fleet/bin/launch-seat.sh', 'operator'],
+      ['fleet/bin', 'operator'], // the directory itself is unlisted
+    ];
+    for (const [path, want] of expected) {
+      const ts = resolveOwnership(manifest, path);
+      expect(ts).toBe(want);
+      expect(bashResolve(path)).toBe(want);
+    }
+  });
 });
 
 /**