fix(OperationsCenter): widen executor-backend self-heal to critique_executor

[ProtocolWarden]

Two fixes, both path/list assumptions that silently covered less than they claimed.

1. ensure_executor_backends() covered two of three backends

scripts/operations-center.sh reinstalls dropped executor sibling checkouts at every fleet launch, but it probed import team_executor, dag_executor and looped over TeamExecutor DAGExecutor.

critique_executor — imported as a library by backends/critique_executor/adapter.py, backed by the sibling checkout ../CritiqueExecutor — was in neither list. A uv sync or venv-recreate that dropped it was therefore not auto-repaired, so every critique-topology task failed at execute with No module named 'critique_executor' until a human noticed. That is the exact failure mode this self-heal exists to prevent for the other two.

The drift was structural: the probe and the install loop were two separate hardcoded lists inside one function, so widening one without the other was easy and silent. They are now a single EXECUTOR_BACKENDS array of <import name>:<sibling checkout dir> pairs, and both the probe's import statement and the install loop derive from it. Behaviour is otherwise unchanged — still all-or-nothing, and a missing uv or a missing checkout still degrades to a WARNING rather than aborting launch.

Not sourced from Python, deliberately. The nearest real Python lists are BackendName / EXECUTOR_LANE_NAMES (contracts/enums.py) and the backends/factory.py registry, but neither carries the checkout-dir half of each pair, and it is not derivable (dag_executor → DAGExecutor, not DagExecutor). More fundamentally this self-heal has to run precisely when the venv is too broken to import operations_center. Cross-reference comments now sit in both scripts/operations-center.sh and backends/factory.py, each naming the other.

2. .hooks/pre-push resolved the wrong workspace root inside a worktree

The hook globs sibling checkouts for the boundary disclosure artifact using workspace_root="$(cd "$repo_root/.." && pwd)". That assumes $repo_root is the main clone. In a git worktree it is .../OperationsCenter/.claude/worktrees/<name>, so workspace_root became .../.claude/worktrees — a directory with no siblings. The glob matched nothing and every push from a worktree failed closed on a missing REPOGRAPH_BOUNDARY_ARTIFACT_FILE it had no way to find.

Now derived from git rev-parse --git-common-dir, which the main clone and all its worktrees share.

Verification

Against the live stack (~/GitHub/{TeamExecutor,DAGExecutor,CritiqueExecutor}):

• bash -n clean; the probe builds exactly import team_executor, dag_executor, critique_executor.
• Silent no-op, rc=0, against the real fleet venv where all three already import.
• Against a throwaway empty venv the real uv path installed all three (+ critique-executor==0.1.0 from file:///home/diane/GitHub/CritiqueExecutor), all three then imported, and a second call was a silent no-op. Fleet venv untouched.
• Hook: worktree now auto-discovers the artifact; main clone resolves to the identical path as before.
• tests/unit/backends/test_factory.py + test_critique_executor_adapter.py: 5 passed. ruff check + ruff format --check clean.
• This branch was pushed through the real pre-push Custodian gate with no bypass and no env override: 0 findings / 0 HIGH / 0 MED / clean.

Context: the gate was blocking every push

Getting here surfaced two faults outside this repo, both now fixed:

• The WSL2 fleet clone had no boundary artifact anywhere under ~/GitHub, so its own pre-push failed at B2 before Custodian ran. PrivateManifest was not checked out there at all; it now is, and the artifact is generated from it.
• Custodian's find_tool() preferred its own venv over the audited repo's, so a globally-installed custodian-multi audited OC (pinned ruff==0.15.13) with a system-wide ruff 0.16.1 and reported 1222 phantom findings against a clean tree. Fixed upstream in fix(adapters): find_tool must prefer the AUDITED repo's venv, not Custodian's Custodian#72.

The OC baseline was never dirty.

🤖 Generated with Claude Code