merge: absorb main into next — 23-commit divergence (08-05..13 base=main window)

17 content commits + 3 merge bubbles were genuinely missing from next (~8,000 lines:
goal controller #1152, framework enforcement #1174/#1195, pr-edit wrapper #1173/#1200,
pipefail series #1100/#1105/#1106/#1107, git-tools fixes #1073/#1085/#1086/#1089,
#991, #1007, enrollment tolerance #1094). 3 commits were already in next by content
(#1060 identical, #1066/#1062 evolved twins — conflicts resolved to next's side).

Per-commit classification and evidence: mosaic-brain fleet/lanes/stack-remediation/main-next-divergence.md.
Conflict resolutions (6 files) itemized in the PR body.

tools/install.sh

@@ -523,13 +523,17 @@ ensure_monorepo() {
     exit 1
   fi
 
-  # Gitea archives extract to <repo-name>/ inside the work dir
-  EXTRACTED_DIR="$(find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d | head -1)"
-  if [[ -z "$EXTRACTED_DIR" ]] || [[ ! -d "$EXTRACTED_DIR" ]]; then
-    fail "Could not locate extracted source in archive."
+  # Gitea archives extract to exactly one <repo-name>/ inside the work dir.
+  # Read the complete population so a malformed multi-root archive reaches the
+  # named diagnostic instead of aborting on an upstream SIGPIPE under pipefail.
+  local -a extracted_dirs=()
+  mapfile -d '' -t extracted_dirs < <(find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d -print0)
+  if [[ "${#extracted_dirs[@]}" -ne 1 ]] || [[ ! -d "${extracted_dirs[0]:-}" ]]; then
+    fail "Could not locate exactly one extracted source directory in archive."
     ls -la "$WORK_DIR" >&2
     exit 1
   fi
+  EXTRACTED_DIR="${extracted_dirs[0]}"
 }
 
 # Build @mosaicstack/mosaic + @mosaicstack/gateway from source and install both