feat: add agent fleet routing and durable completion reports

[ruby-dlee]

Intent

Finalize Firstmate Agent Fleet PR #2 as the backward-compatible code foundation for the Bridge cutover.
The change adds dynamic Claude/Codex account-profile routing and cross-profile continuation with task state outside account homes, Herdr runtime integration, an enforced durable completion-report contract, and the /reports review surface.
Merging this PR does not activate those paths: the live backend remains tmux, account routing remains absent/off, all profiles remain disabled, and no report-retention owner is installed.

What changed

• Add default-off Agent Fleet routing for Claude and Codex account pools, including atomic profile leases, quota-aware selection, session reconciliation, sticky recovery, and cross-profile continuation.
• Add enforced completion reports with fail-closed publication, preserved task artifacts, searchable HTML review pages, and bounded opportunistic retention.
• Harden spawn, recovery, AFK, watcher, send, and teardown lifecycles across tmux, Herdr, cmux, zellij, secondmates, and X-mode integrations.
• Preserve compatibility for existing pre-cutover tasks and leave all runtime activation behind machine-local configuration gates.

Owner decisions preserved

• Routing remains off and profiles remain disabled at merge time.
• Existing tasks, secondmates, tmux windows, and worktrees are not migrated.
• The captain remains Claude in tmux and outside Agent Fleet.
• No heuristic report-content/redaction gate and no report-retention LaunchAgent are introduced.
• Orca report-required spawns refuse before mutation.

Exact-head verification

• Final reviewed head: c5f00a03139f2d1379c1c947f8c559a43d0101e9.
• Local worktree HEAD, origin/codex/agent-fleet-integration, and GitHub PR head are identical.
• Upstream-sync base: 055868c501f746b2fbd6018bbea01de94498e589, including the accepted upstream sync through kunchenguid/firstmate 8c0d9eb.
• The feature worktree is clean and origin/main is an ancestor of the exact head (0 behind, 103 ahead before merge).
• Exact-head review means the no-mistakes pipeline plus independent finalization/cutover-agent review. Bugbot is not installed on ruby-dlee/firstmate; no Cursor/Bugbot verdict is claimed.

Testing

GitHub reports four passing checks and zero failures at the exact final head:

• Behavior tests - passed.
• Lint shell scripts - passed.
• Repo invariants - passed.
• PR must be raised via no-mistakes - passed.

The earlier 8b935127 container-only-marker risk paragraph is obsolete.
The completed fix rejects bare Markdown container markers, and the final behavior suite is green at c5f00a0.

Activation blocker discovered after exact-head review

An isolated live survival lab on 2026-07-17 proved that the current fm_backend_herdr_server_ensure launch shape does not survive destruction of its caller's tmux pane lineage: both the server and a dummy pane agent died.
This is not a merge blocker because this PR is inert under the existing backend=tmux and routing-off configuration.
It is a hard activation blocker: a separate detached-lifecycle hardening PR must merge and the survival lab must pass before any real task is routed to Herdr.