feat(loop): enforce driver one-shot contract — post-exit verify + debris classifier + tests (#111)

[robercano-ghbot]

What & why

First scoped slice of #111. The autonomous PR loop was wedged twice by drivers that ended their headless one-shot turn without a published result:

• Worktree hygiene: auto-remove worker worktrees (and branches) after their PR merges #91/Cockpit: group Live worker progress by task, link issue/PR, and make columns sortable #92: background orchestrator killed after the grace ceiling → half-born feat/issue-N-* branches, rc=0 phantom success in the ledger, census read the local branches as in_flight and skipped the issues.
• Loop daemon: harden runtime-env resolution — bake resolved PATH into installed units, don't depend on nvm sourcing at runtime #107 → PR Loop daemon: bake resolved node/claude PATH into pr-loop.service unit #117: a driver killed after committing gates-green work but before pushing — proving the original "delete the debris" design would have destroyed real work.

This slice adds post-exit verification and a debris CLASSIFIER (not a blind deleter) at the driver post-exit boundary in the daemon.

Changes (all within .claude/, module: harness)

• Fail-fast spawn (issue pt 4): run_driver exports CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 (overridable) so backgrounded work dies loudly instead of half-completing.
• classify_debris <branch> <worktree_dir> (pt 2): deterministic, pure-git, network-free → empty | publishable | half-done (absent for a missing branch). Shares states with Loop: failure classification + crash-resume for dead workers (the recovery half of loop-health) #98's classifier.
• verify_and_classify_post_exit (pt 1): for advance issue=N verdicts with a non-timeout rc, queries GitHub via bot-gh.sh for the issue's open PR; records pr=<n>; rewrites result=exit rc=0 → result=phantom when rc=0 but no PR exists. Offline/failed bot-gh.sh degrades to verify=skipped with zero destructive action.
• Mechanical case A only: empty + no PR + feat/issue-N-* branch → delete branch + worktree (action=deleted). This is the only destructive path, reachable solely on the provably-empty state. publishable/half-done are never deleted (half-done → resumable).
• Ledger honesty: still exactly one ledger line per run, now carrying result=… [pr=…] [debris=…] [action=…]; run_driver's return-code contract is preserved.

Tests

• loop-event.test.sh (23→29): regression guards asserting the ADVANCE and FEEDBACK driver prompts contain the three one-shot contract clauses (foreground-only spawn, "do NOT end your turn until the work product exists on GitHub", delete-debris-on-failure) — guards hotfix d37e951.
• loop-daemon.test.sh (22→47): behavioral CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 assert; phantom (rc=0 + no PR → result=phantom); classify_debris unit tests (empty/publishable/half-done/absent, real git fixtures); Case A actual branch+worktree deletion; Case C safety (nothing deleted, branch survives, resumable); offline bot-gh.sh → verify=skipped.

Gates

.claude/self/gates.json: build / lint / test (checks.sh + smoke-fanout) all green. Reviewer lenses (correctness=opus, tests=sonnet, consensus=all) both APPROVE; the tests reviewer mutation-tested the Case A/C/phantom assertions to confirm they bite.

Deferred (follow-ups)

• Case B automated publish execution (re-run test gate, push, open PR) — classifier already detects publishable; execution deferred.
• Case C model-driven continuation driver / claude --resume — belongs to Loop: failure classification + crash-resume for dead workers (the recovery half of loop-health) #98 by the issue's scope note.
• WIP-commit-at-milestones mandate in agent prompts (issue pt 5) — separate slice.
• WIP-commit preservation for dirty half-done worktrees (currently recorded/resumable, never auto-committed).

Closes #111