#1356 review SF1+SF2: enumerate login-resolution suite into CI; document the tea login ladder and seat-logins.sh

SF1: test-gitea-login-resolution.sh runs 3/3 green under an empty HOME (no tea
config, no credentials, no brain), so its #1007 'resolves real credentials'
exclusion is stale. Added to ci.yml next to the other hermetic git suites and
removed from the exclusions file. Control: re-adding the exclusion line turns
check-test-enumeration.sh red (rc=1).

SF2: tools/git/README.md identity section now carries the tea-path ladder
(identity -> instance -> <instance>-<identity> login -> fail closed) and points
at tools/fleet/seat-logins.sh as the projector that provisions those logins.

.woodpecker/ci.yml

@@ -91,6 +91,11 @@ steps:
       # and sandboxes a throwaway git repo, so it resolves no real credentials and
       # joins CI directly rather than the exclusions file.
       - bash packages/mosaic/framework/tools/git/test-issue-close-fail-closed.sh
+      # Hermetic regression for the git identity ladder (#1356): mock tea on PATH,
+      # sandboxed repo, no real credentials (3/3 green under an empty HOME). Pins
+      # fail-closed: a seat whose login is missing gets a named error, never a
+      # borrowed identity. Joins CI directly; its #1007 exclusion is burned down.
+      - bash packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh
       # Hermetic behavioural regression for the PreToolUse wrapper guard: proves
       # it still blocks the three mistakes AND still lets reads, unwrapped
       # endpoints and ordinary commands through. Both directions are asserted —