Convergence correctness: make the post-state provably coherent, derive the primary from git's roster, and produce the first WET execution evidence for repository_convergence

[gunbai-bot]

Auto-opened by session-dashboard for session eager-fox-241.
Pushing to session/eager-fox-241 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d01f0b9d75

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject linked-worktree paths before mutating the repository

When repo names a linked worktree, as in the new wrong_primary_standing_refuses_from_gits_roster scenario, this check validates only observability and then allows the fetch, base-ref CAS, and hard reset to run. The later verdict derives the main worktree from the roster and returns a failure, but by then the shared base ref has advanced and the linked worktree's branch, index, and files have been reset. Compare repo with the observed roster's primary path and refuse before the fetch/CAS so this wrong-standing failure is non-destructive.

Useful? React with 👍 / 👎.