fix(teardown): safely retire landed detached tasks

[quinnbot-ai]

Summary

• Accept only the exact window_detached_20260810 legacy Herdr incident marker after strict endpoint and candidate identity validation.
• Preserve the existing remote, PR, and content landing proof as the sole cleanup authority.
• Refuse force, malformed or contradictory metadata, unsafe paths, ambiguous candidates, unlanded work, and retained presentation journals.
• Add an eight-record end-to-end fixture inventory plus landed, unlanded, ambiguous, malformed, symlink, contradictory, and current-metadata regressions.

Validation

• bin/fm-test-run.sh tests/fm-teardown.test.sh
• bin/fm-test-run.sh tests/fm-teardown-endpoint-safety.test.sh
• Adjacent secondmate lifecycle, decision-hold lifecycle, session-lock ancestry, watcher-lock, and remote-secondmate lifecycle suites.
• bin/fm-lint.sh
• bin/fm-doc-audience-check.sh
• Changed-scope suite with all task-owned cases green.
• fm-review-diff and the late Herdr presentation concurrent-recovery case fail identically on pristine current fork main at 19f9d483fa30d8abf7785023aa6023e77a52dcb6, classifying both as environmental baseline failures.
• Final scoped adversarial review found no weakening of teardown or landing authority.