fix(dispatch): surface auth_required cause on unranked AGY quota rows

[Ivory2024]

Intent

GY/AGY quota가 계속 미측정으로 표시되는 원인을 끝까지 재현하고, 가능한 범위에서 Firstmate와 quota 표시를 고친다.

What Changed

• bin/fm-dispatch-resolve.sh: add uncertainty($p) jq helper that reads a provider's state.status/state.error; when unmeasured, attach it as an uncertainty field on the candidate.
• Render the uncertainty value inline in the CLI's unranked-candidate line (eligible, unranked: ... [auth_required: <error>]: disclosed uncertainty) instead of only showing the generic "unmeasured" reason.
• tests/fm-dispatch-resolve.test.sh: add a case forcing AGY into auth_required state, asserting the cause shows in output, no quota scope is fabricated, and AGY is never chosen for dispatch.
• docs/verification/dispatch-resolve.md: document the new auth_required coverage in the test-proof summary.

🤖 Generated with Claude Code

Risk Assessment

✅ Low: Small, single-purpose jq change (2 files) that adds an uncertainty field surfacing auth_required cause only in existing unmeasured branch; null-safe on missing prov/state fields, no regression to other unranked reasons, and covered by a new test matching exact output format.

Testing

Ran the actual CLI script live through its existing end-to-end test harness: happy path (auth_required AGY quota row now exposes cause in dispatch output) passes on the fix commit and provably fails on the pre-fix commit; also confirmed adversarial guards (no fabricated scope, no AGY dispatch authorization) hold. No code or test changes needed; worktree left clean.

• Live validation: ✅ go - 4 of 4 scenarios driven live against the product

Scenario	Result	Live	Evidence
AGY quota reports auth_required — dispatch surfaces the real cause	✅ pass	live	tests/fm-dispatch-resolve.test.sh output: 'candidate: agy:- provider=agy -> eligible, unranked: provider agy unmeasured (unknown) [auth_required: Antigravity sign-in required]: disclosed uncertainty'
Adversarial: auth_required must not fabricate a quota scope or authorize AGY dispatch	✅ pass	live	assert_not_contains checks in the same test case passed: no 'scope=' fragment and no 'profile: --harness 'agy'' line emitted
Regression: pre-fix script silently swallows the auth_required cause	✅ pass	live	Same test run against base-commit bin/fm-dispatch-resolve.sh failed with 'not ok', output showed plain 'unmeasured (unknown): disclosed uncertainty' with no auth cause — proves the new test is not vac…
Existing dispatch-resolve behaviors unaffected (other providers, error paths, ranking logic)	✅ pass	live	All other 18 pre-existing cases in tests/fm-dispatch-resolve.test.sh still pass unchanged

Evidence: fm-dispatch-resolve test suite run (target commit)

ok - auth_required AGY evidence stays unknown while its external cause remains visible
# all fm-dispatch-resolve tests passed

Evidence: Regression proof: same test against base commit script

not ok - auth_required remains unranked and exposes the external authentication boundary (missing: 'candidate: agy:- provider=agy -> eligible, unranked: provider agy unmeasured (unknown) [auth_required: Antigravity sign-in required]: disclosed uncertainty')
candidate line at base commit: 'candidate: agy:- provider=agy -> eligible, unranked: provider agy unmeasured (unknown): disclosed uncertainty'

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Live validation: ✅ go - 4 of 4 scenarios driven live against the product

Scenario	Result	Live	Evidence
AGY quota reports auth_required — dispatch surfaces the real cause	✅ pass	live	tests/fm-dispatch-resolve.test.sh output: 'candidate: agy:- provider=agy -> eligible, unranked: provider agy unmeasured (unknown) [auth_required: Antigravity sign-in required]: disclosed uncertainty'
Adversarial: auth_required must not fabricate a quota scope or authorize AGY dispatch	✅ pass	live	assert_not_contains checks in the same test case passed: no 'scope=' fragment and no 'profile: --harness 'agy'' line emitted
Regression: pre-fix script silently swallows the auth_required cause	✅ pass	live	Same test run against base-commit bin/fm-dispatch-resolve.sh failed with 'not ok', output showed plain 'unmeasured (unknown): disclosed uncertainty' with no auth cause — proves the new test is not vac…
Existing dispatch-resolve behaviors unaffected (other providers, error paths, ranking logic)	✅ pass	live	All other 18 pre-existing cases in tests/fm-dispatch-resolve.test.sh still pass unchanged

• bash tests/fm-dispatch-resolve.test.sh (full suite, target commit) — all 19 cases pass, including new 'auth_required AGY evidence stays unknown while its external cause remains visible'
• Regression check: swapped bin/fm-dispatch-resolve.sh to base commit content, reran same test file — new case fails with exact expected diff (missing '[auth_required: Antigravity sign-in required]' clause), proving the test is a real regression test tied to this fix; restored file via git checkout

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.