fix(git): push-guard — resolve 5 review blockers + a 6th self-found instance

Authored by installer-7; committed by mos-claude (installer-7 has no credential for this remote).
All five blockers from rev-974's review were REPRODUCED before any fix.

B1 mode 100644: the artifact was never executable, so an untouched clone could not run the
   suite at all (exit 126) — both prior 32/32 runs used a local exec bit set at creation.
   Fixed in the INDEX (git update-index --chmod=+x), plus verify-clean-clone.sh which asserts
   the mode via 'git ls-files -s' (not disk) and executes the suite DIRECTLY ('bash script'
   masks a missing bit). Negative control: chmod 644 makes the verifier refuse.
B2 mapfile < <(git diff) observed mapfile's status, not the producer's — a fatal pathspec
   error reported a clean scan, exit 0. pipefail governs PIPELINES; a process substitution is
   an async child whose status is never collected.
B3 OFF accepted from an untracked working-tree config, defeating the committed-artifact
   asymmetry — and write_config() wrote untracked configs, so every opt-out control asserted
   the forbidden provenance and passed green. OFF is now re-read from HEAD; untracked,
   staged-uncommitted, committed-symlink, and committed-ON-flipped-locally are all refused.
B4 --since-head proved inequality, not ancestry: an unrelated pre-existing commit passed as
   new work.
B5 empty ROOT commit exempted by parent-count, then reported PUSH CONFIRMED. Emptiness is now
   defined as 'tree identical to every parent' rather than exempted by category.
B6 (self-found by sweeping for the CONSTRUCT, not the report) same < <(git diff) in
   cmd_check_staged — fails closed but published a wrong diagnosis. Both callers now route
   through one staged_files_z().

41/41 needles, executed directly from a clean clone. Known gap, stated: B2's second instance is
fixed but UNNEEDLED — a corrupt index aborts earlier at 128, so no fault injection reaches it.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YKj59Qadrb2WBLaePvkM7H

packages/mosaic/framework/tools/git/verify-clean-clone.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# verify-clean-clone.sh -- run the suite from a FRESH CLONE, never the working copy.
+#
+# BLOCKER 1 EXISTED BECAUSE EVERY RUN HAPPENED WHERE THE EXEC BIT WAS ALREADY SET.
+# Two people ran 32/32 on files whose local mode had been set by hand at creation
+# time; the COMMITTED mode was 100644, so the delivered artifact returned 126
+# Permission denied and aborted before printing a summary. The artifact had never
+# run for anyone.
+#
+# "Run it somewhere real" was not enough. The missing word is CLEAN: run it from a
+# checkout that carries only what the repository actually stores. Local state you
+# did not commit is invisible to you precisely because it is yours.
+#
+# This script commits the artifacts into a scratch repo, clones that repo, and
+# runs the suite from the clone -- so the only modes in play are the ones git
+# recorded. It also asserts the mode positively, so a future commit that drops the
+# bit fails here instead of at the next reviewer.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+ARTIFACTS=(push-guard.sh test-push-guard.sh)
+
+printf '=== packaging from %s ===\n' "$HERE"
+mkdir -p "$WORK/src"
+for f in "${ARTIFACTS[@]}"; do
+    cp "$HERE/$f" "$WORK/src/$f"
+done
+[[ -f "$HERE/README.md" ]] && cp "$HERE/README.md" "$WORK/src/README.md"
+
+cd "$WORK/src"
+git init -q .
+git config user.email "[email protected]"
+git config user.name "Clean Clone"
+git add -A
+
+# THE ASSERTION THAT WOULD HAVE CAUGHT BLOCKER 1.
+# Check the mode in the INDEX -- what git will actually store -- not the mode on
+# disk, which is what misled us. These differ exactly when it matters.
+rc=0
+for f in "${ARTIFACTS[@]}"; do
+    mode="$(git ls-files -s -- "$f" | awk '{print $1}')"
+    if [[ "$mode" != "100755" ]]; then
+        printf '  FAIL  %s is mode %s in the index (needs 100755)\n' "$f" "$mode"
+        printf '        fix with: git update-index --chmod=+x %s\n' "$f"
+        rc=1
+    else
+        printf '  ok    %s is mode %s in the index\n' "$f" "$mode"
+    fi
+done
+(( rc == 0 )) || { printf '\nREFUSING TO CONTINUE: the committed modes are wrong.\n'; exit 1; }
+
+git commit -q -m "artifacts under test"
+
+printf '\n=== cloning (no local mode bits survive this) ===\n'
+cd "$WORK"
+git clone -q src clone
+cd clone
+
+for f in "${ARTIFACTS[@]}"; do
+    printf '  clone mode: %s %s\n' "$(stat -c '%a' "$f")" "$f"
+done
+
+printf '\n=== executing DIRECTLY (./script), not via `bash script` ===\n'
+# Running `bash script` masks a missing exec bit completely -- it is how the
+# original 32/32 was obtained. Direct execution is the thing under test.
+if ! ./test-push-guard.sh; then
+    printf '\nCLEAN-CLONE RUN FAILED.\n'
+    exit 1
+fi
+
+printf '\n=== CLEAN CLONE: suite ran and passed from a fresh checkout ===\n'