fix(spawn): preserve isolated copies across recovery relaunch and agent exit

[wuzihuang]

Two related isolated-copy defects, fixed on one branch.

1. Recovery relaunch could orphan the recorded copy

A ship/scout spawn for a task id that already had state/<id>.meta ran the fresh-allocation path unchanged: treehouse handed out another worktree and the metadata write truncated the record, so the recorded copy - which can hold uncommitted edits and unpushed commits - was left with no durable owner, and a still-live recorded agent meant two workers on one task identity. The backends' own duplicate refusals never covered it: tmux only refuses while the task window still exists, which is exactly what an interrupted task no longer has.

An existing record is now authoritative. The relaunch re-enters the recorded copy only when ownership is provable - intact record, matching backend, kind and project, recovery-grade dead or missing endpoint, an unambiguous worktree entry still resolving to an isolated worktree root, and provable durable protection - and otherwise refuses with every record and copy left intact.

2. A normal agent exit could delete an isolated copy's untracked content

A copy held only by an interactive treehouse get subshell lives exactly as long as that subshell. A pane falls back to it the moment its agent exits normally - the ordinary end of a non-Claude harness session - and treehouse then offers to clean and return the copy with an affirmative default, so one stray Enter recycles the pool slot and deletes every untracked file in it. Verified against real treehouse in a throwaway pool: a subshell exit removed an untracked handoff note and flipped the slot to available.

Fresh copies are now acquired as durable leases held by fm-<task-id> and entered with cd, the same durability already used for secondmate homes. A lease survives with no live process, is never handed out by a later get or removed by prune, and is released only by teardown's explicit return. A failed lease is terminal, never a fallback to the interactive form, and a spawn releases a lease it just acquired only when it aborts before recording the task and the copy holds no uncommitted or untracked content.

Legacy copies

Copies acquired before leasing cannot be leased retroactively, so a relaunch refuses them by default. bin/fm-adopt-worktree.sh is the guarded, operator-invoked adoption path: it verifies the record, the project, a dead or missing endpoint and an adoptable pool state, captures a content manifest of everything uncommitted and untracked, and never writes into the copy. A relaunch then re-verifies both the current pool state and that manifest, and a current pool lease matching the task is authoritative proof on its own.

Coverage

• tests/fm-spawn-recovery-guard.test.sh - relaunch reuse, refusals, adoption proof, pool-state revalidation.
• tests/fm-spawn-worktree-preservation.test.sh - real-treehouse comparison of the destructive and protected exit shapes, and adoption of a real unleased copy holding an untracked handoff note.
• tests/fm-adopt-worktree.test.sh - adoption ownership, integrity and refusal paths.

No git reset, git clean, force operation or stash anywhere, and no automatic return, deletion or cleanup of any existing copy.