fix: require merge evidence for passed crew runs - #39

CEO overview

• What is changing: Firstmate only reports a worker's pull request as merged when it has matching merge evidence.
• Why it matters: A finished worker could previously appear to have landed its work while its pull request was still open.
• Customer or business impact: The captain can distinguish work ready for review from work already merged, reducing the risk of overlooking unfinished delivery.
• Risk and rollout: Low risk; this delivery stops when CI is ready for review, with merging reserved for the captain's approval.
  Active workers keep their current status, and safeguards still refuse to remove unlanded work.
  Older runs without matching evidence may now show that their merge is unverified.

What changed technically

• Passed crew runs require matching current-run PR identity, task metadata, and owned PR-poll merge evidence before displaying PR merged/closed.
• Missing or conflicting evidence produces PR merge unverified; runs without valid PR metadata retain plain run passed.
• Regression coverage exercises the public crew-state interface and teardown refusal, including stale evidence for a different PR on the same branch and head.
• The decision re-arm test uses changing pane output and waits for observed captures so an independent idle-pane wake cannot be mistaken for a duplicate decision.

Validation

• Checks passed: The preceding pipeline phases passed targeted crew-state, PR-poll, teardown, shell portability, lint, and documentation checks.
  CI also passed both portable parallel shards, serial shards 1, 3, and 4, Herdr, stock macOS Bash compatibility, coverage, repository invariants, and the no-mistakes requirement.
  After the CI repair, the full inactive-reconciliation and PR communication suites, both PR-body checkers, targeted ShellCheck, Bash syntax, documentation audience checks, and diff checks passed locally.
• Checks not run: Hosted communication checks have not passed against this replacement narrative; the live PR description still uses the rejected legacy headings.
  The outer executor must compose this narrative with the latest live body using bin/fm-pr-body-compose.sh, publish the result while preserving the machine-owned Pipeline section, and verify the resulting hosted checks.
  No live forge mutation or merge was performed.
• Evidence and limitations: Isolated public-script fixtures reproduced the false merge claim and verified the corrected open, merged, and closed-unmerged paths, while teardown preserved unlanded work.
  The live PR body reproduces all nine missing-field failures locally; replacing only its narrative with this file passes both executable body checkers while preserving the existing Pipeline suffix.
  Committing this file alone does not update the live body that GitHub Actions assesses.
  The crew-state transcript, poll-to-watcher transcript, and teardown transcript use controlled forge responses rather than live GitHub state.

Module-boundary decision

Current module retained: crew-state owns the displayed run verdict and reuses the existing PR identity and owned merge-evidence helpers.
No new merge authority or cleanup path is introduced.

Decision needed

No implementation decision required.
Merge approval remains with the captain; this validation run does not authorize merging.

Pipeline

Updates from git push no-mistakes