fix(bin): retire cleared lane records and stop their wakes

[keenvc]

What

Two lane-accounting leaks, shipped as one coherent fix.

1. A lane whose endpoint was cleared can now be retired

bin/fm-backend.sh's endpoint validator required a window= line, so a record
carrying an explicit endpoint_cleared=<reason> stamp and no window refused on
every teardown path, including --legacy-record. Five live records with merged
PRs and absent worktrees read as in flight for weeks.

fm_backend_validate_task_endpoint gains --allow-cleared: a record with no
window but one explicit, non-empty endpoint_cleared stamp is accepted as an
agent-less cleared endpoint (target empty, FM_BACKEND_VALIDATED_ENDPOINT_CLEARED
set). Teardown consumes that contract: it skips the Herdr preflight, pane close,
confirmed-gone gate, and transition clear, and never issues an endpoint command.
The cleared stamp also satisfies the incarnation gate for a record that predates
spawn_gen, so no --legacy-record is needed. The unlanded-work refusal is
untouched, and --force remains the only way to discard work.

2. A projected workspace is removed, not just its pane

Teardown confirmed only the recorded task pane was gone, so a projected Herdr
workspace whose pane had already vanished before its close survived for a
restart to restore as a live agent with its working directory set to the primary
clone.

New fm_backend_herdr_projection_workspace_remove_focus_preserving closes any
panes the disposable workspace still holds through the existing
focus-preserving pane close (refusing a live or unknown agent), and teardown
retires the journal only once the workspace itself is confirmed gone. It never
calls workspace close.

3. A dead pane stops waking once its record is known dead

wedge_dead_record reports a dead endpoint once, but only from the wedge timer,
which runs on a stable hash. A husk whose display redrew re-entered the
first-sight surface path on every new hash. A new dead_endpoint_absorb consults
the once-record and absorbs a changed dead display while the pane reads idle and
the marker's incarnation still matches, so a relaunched agent re-arms the
incarnation and its own death still reports in full.

Tests

• tests/fm-teardown.test.sh: cleared endpoint tears down with no flag or
  --force; cleared endpoint still refuses unlanded work; a missing window
  without a stamp still refuses; a projected workspace left by the task-pane
  close is removed without workspace close; a surviving workspace refuses and
  retains every record.
• tests/fm-watch-triage.test.sh: a reported-dead window absorbs a redrawn
  display under the same incarnation and re-reports a successor's death.

Portable and driven through each script's own CLI; no implementation-source
assertions. bin/fm-lint.sh, bin/fm-doc-audience-check.sh,
tests/fm-teardown.test.sh, tests/fm-watch-triage.test.sh,
tests/fm-teardown-endpoint-safety.test.sh, tests/fm-herdr-session-cleanup.test.sh,
and tests/fm-backend-herdr.test.sh all pass.

[kunchenguid]

Speaking as Kun's firstmate:

First look on HEAD da76467d36fc1470d9625d09cae2545d48a7d135 vs main dd9b2ef21fe6c06846ae74d9070ac2da971ae8e7. Whole thread read (body; no prior comments). Attestation MISMATCH (no no-mistakes-pipeline-attestation block in body). ~527 LOC across teardown/backend/watch + tests.

Contract-class: restore. Independent tip-vs-main on the unconfigured path:

1. Main already documents dead endpoints are reported ONCE via wedge_dead_record; tip adds dead_endpoint_absorb so a redrawn dead display under the same incarnation cannot re-enter the first-sight surface and re-wake — restores that once-report contract.
2. Main Herdr presentation teardown already closes the recorded task pane; tip fm_backend_herdr_projection_workspace_remove_focus_preserving finishes removal when the pane is already gone so a restart cannot resurrect a husk in the primary clone — restores teardown completeness.
3. --allow-cleared accepts an explicit single endpoint_cleared= stamp with no window=; unconfigured records without that stamp still refuse as main. Unlanded-work refusal and --force discard gate unchanged.

CI/NM: tip was action_required. Fork workflows approved this pass after diff review (no .github/workflows edits; teardown still refuse-unlanded; no credential surface): CI 35483475080, Require no-mistakes 35483475076 — queued. MERGEABLE/UNSTABLE. no-mistakes blocking; missing attestation keeps NM red until rebound.

VISION.md (each rule)

• One captain, one interface: aligns — fewer false dead-endpoint wakes.
• Authority is explicit: aligns — no new autonomy; --force still sole discard grant.
• Scripts own the mechanics: aligns.
• A restart is a non-event: aligns — husk workspace no longer resurrects wrong agent.
• Delegation with a spine: aligns.
• The fleet outlives any vendor: aligns (Herdr cleanup stays in herdr backend).
• Scope: aligns (lane accounting / teardown / watch).

Decision: waiting-author — add matching pipeline attestation for this HEAD. Restore + safe review → auto-merge candidate once attestation MATCH and CI+NM green. No Firstmate flag. Security: clean. No Closes/Fixes issue claims verified.