Harden Nightshift from live validation runs

[HarshyChoc]

Summary

• harden Nightshift worktree and target-repo validation based on live Codex/tmux runs
• enforce more of the cycle contract in the runner instead of relying on prompt compliance
• improve short-run fix selection by steering the agent toward high-signal auth/http/api helper paths

What changed

• validate and recover broken worktrees before a cycle starts
• fail fast with a clear error when the target repo is not a valid git checkout
• reject repo-wide cycle commands like npm run lint, npm run test, and npm run build
• verify forbidden commands from structured output fields as well as raw Codex JSONL
• enforce one-fix-one-commit cycle accounting
• avoid generating blocked npm lockfiles in lockfile-less repos during dependency install
• add repo-aware high-signal focus hints for short validation runs

Validation

• full test suite passes locally: 164 passed
• live Nightshift runs were exercised against a fresh standalone copy of Reclip-Reposter-Hub
• those runs surfaced runner issues which drove the commits on this branch
• latest clean target run produced a relevant logged security issue (parse-social-url hostname validation) that matched manual repo review

Notable commits

• 7883afe validate broken worktrees before cycles
• d51e0b0 surface invalid repo checkouts early
• b9e6d5e reject forbidden repo-wide cycle commands
• 96d1de0 enforce one-commit-per-fix cycles
• 456065b avoid generating blocked npm lockfiles
• d85c1f5 steer short runs toward high-signal paths