fix(fleet): propagate roster git identity (#1073)

Co-authored-by: be-coder-06 <[email protected]>

packages/mosaic/src/fleet/generated-env-boundary.spec.ts

@@ -22,6 +22,7 @@ import {
 
 const generatedValues = {
   MOSAIC_AGENT_NAME: 'coder0',
+  MOSAIC_GIT_IDENTITY: 'coder0',
   MOSAIC_AGENT_CLASS: 'code',
   MOSAIC_AGENT_RUNTIME: 'pi',
   MOSAIC_AGENT_MODEL: 'openai-codex/gpt-5.6-sol',
@@ -45,6 +46,7 @@ describe('generated fleet agent environment boundary', (): void => {
     expect(renderGeneratedAgentEnvironment(generatedValues)).toBe(
       [
         'MOSAIC_AGENT_NAME=coder0',
+        'MOSAIC_GIT_IDENTITY=coder0',
         'MOSAIC_AGENT_CLASS=code',
         'MOSAIC_AGENT_RUNTIME=pi',
         'MOSAIC_AGENT_MODEL=openai-codex/gpt-5.6-sol',
@@ -78,6 +80,22 @@ describe('generated fleet agent environment boundary', (): void => {
     expect(String(error)).toMatch(/key=.*sha256=/);
   });
 
+  it.each([
+    ['unsafe-git-identity', 'other/identity'],
+    ['git-identity-mismatch', 'reviewer0'],
+  ])('rejects %s before any launch consumer can use it', (code: string, identity: string): void => {
+    expect((): void => {
+      renderGeneratedAgentEnvironment({
+        ...generatedValues,
+        MOSAIC_GIT_IDENTITY: identity,
+      });
+    }).toThrow(
+      expect.objectContaining({
+        diagnostic: expect.objectContaining({ code, key: 'MOSAIC_GIT_IDENTITY' }),
+      }),
+    );
+  });
+
   it('rejects unsafe generated paths before any launch consumer can use them', (): void => {
     expect((): void => {
       renderGeneratedAgentEnvironment({