fix(azure): offload detached gate validation privately

[ruby-dlee]

Intent

PR 327 head feb1b2f is the exact base. Live break-test run 01M0XP2M07JJCTRDG1TQMTGRSM selected test=behavior-heavy from a clean committed detached gate worktree at unadvertised private candidate dfbd137e, but bin/fm-azure-runner.py prepare() called public_origin_proof once with private_source false before reaching the intended direct-private proof and refused that candidate as not the advertised source-ref head. Make the smallest source-ref fix on PR 327: select the --private-snapshot-from-head proof path before any public-candidate advertisement check, while preserving credential-free public remote/default identity, exact synthetic source_ref, clean committed HEAD/object/tree binding, complete non-shallow one-ref bundle verification and digest binding, no capacity parent, and existing retry identity. Ensure one intended origin proof rather than a failing public pre-proof followed by private proof. Add a focused behavioral regression that uses a committed detached unadvertised candidate and fails if prepare attempts a public advertised-candidate proof, then verifies private-direct-bundle mode, exact source head/ref/tree, complete fetchable history, and no parent reservation. Preserve the tracked pytest coverage/liveness proof and YAML route proof. Do not modify shared allocator/daily-bound/capacity-release behavior: the separate zero-compute ccm-0e0afca63b48 release timeout belongs to its allocator owner. Run focused Azure runner tests, bounded normal validation, lint and required CI only. Do not launch another live Azure generation, merge, change Crosscheck tooling, or broaden scope. Push the smallest tested fix to existing PR 327.

What Changed

• Route detached no-mistakes test worktrees through exact private snapshot refs and perform direct-private origin proof before public candidate validation, without reserving validation-cell parent capacity.
• Add a sealed offline Agent Fleet installer and strengthen Azure guest source, capability, bundle, and digest verification.
• Run local Herdr and Agent Fleet validation concurrently, bound and reap validation subprocesses, and add behavioral coverage for routing, source proofs, YAML ownership, and liveness.

Risk Assessment

✅ Low: The direct-private path now performs exactly one private-source origin proof before generic public-candidate checks, while preserving public origin/default identity, local commit/tree binding, complete one-ref bundle verification, digest binding, no-parent semantics, and retry behavior.

Testing

The supplied baseline passed; targeted testing then exercised a committed detached unadvertised candidate end-to-end, confirming one private origin proof, private-direct-bundle identity, exact source ref/head/tree, complete fetchable non-shallow ancestry, digest-backed bundle preparation, and no parent reservation, while preserved pytest liveness/coverage and executable YAML route proofs also passed.

Evidence: Private direct-bundle regression

ok - private prepare binds parent, exact-checkout, and detached direct source graphs

ok - private prepare binds parent, exact-checkout, and detached direct source graphs

Evidence: YAML routing proof

ok - no-mistakes YAML test routing executes the local wrapper and validation shard bridge exclusively

ok - no-mistakes YAML test routing executes the local wrapper and validation shard bridge exclusively

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 bin/fm-azure-runner.py:892 - The required ordering fix is absent. For --private-snapshot-from-head, execution first enters the generic else and calls public_origin_proof(..., private_source=False) at lines 886–891, so an unadvertised detached candidate is rejected before the later private proof runs. This contradicts “select the --private-snapshot-from-head proof path before any public-candidate advertisement check” and “Ensure one intended origin proof.” Branch on private_snapshot_from_head before the generic public path, and make the regression fail on any non-private origin-proof invocation; the current permissive mock at tests/fm-azure-runner.test.sh:391 allows both calls and misses the reported failure.

🔧 Fix: Fix direct private origin proof ordering
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• Configured baseline test command supplied by the outer executor (passed).
• Behavioral selector private_snapshot_prepare_contract from tests/fm-azure-runner.test.sh using real test helpers (passed).
• uv run --with pytest python -m pytest -q tests/test_azure_proof_contracts.py (passed).
• Behavioral selector no_mistakes_yaml_test_route_contract from tests/fm-azure-runner.test.sh (passed).
• git status --short confirmed testing left the worktree unchanged.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.