fix: harden routing and task lifecycle safety

[ruby-dlee]

Intent

Make tests/fm-account-routing.test.sh genuinely green as a whole on macOS Bash 3.2 and Linux CI, restoring PR 35's Behavior checks without weakening or deleting safety assertions for provisional metadata persistence, endpoint installation, secondmate routing-off behavior, or related contracts. Preserve run-unique self-cleaning task temp roots, normalized Darwin sticky-mode parsing, and the supplied secondmate registry fixture. Fix newly exposed defects at their source, replace only genuinely unobservable failure fixtures with deterministic observable injection, and do not modify accepted pre-existing Herdr or checkpoint signal failures unless proven branch-specific. Obtain actual CI runner evidence. Keep fm/fm-routing-suite-s2 rebased onto exact base commit 18f29ab with minimal conflict resolution and verify it cleanly.

What Changed

• Isolate task temporary roots by spawn generation and remove them with descriptor-pinned, fail-closed cleanup across respawn, rollback, and teardown.
• Harden secondmate routing, home seeding, lifecycle validation, and teardown while adding structural dead-endpoint detection for Zellij.
• Restore deterministic macOS Bash 3.2 and Linux regression coverage for routing, lifecycle, rollback cleanup, and backend behavior.

Risk Assessment

✅ Low: The prior unsafe rollback cleanup is now exercised through both direct and managed rollback paths with deterministic failure injection, outside-data preservation, and retry-metadata assertions, with no new material source risks found.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 1 run (2h12m49s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed (2) ✅

• 🚨 bin/fm-spawn.sh:1723 - Rollback cleanup bypasses the new descriptor-pinned remover and calls rm -rf "$TASK_TMP" directly. Because task roots now live beneath $STATE/.task-tmp, a concurrent replacement of that ancestor with a symlink can redirect deletion outside the task namespace. Use fm_account_safe_remove_task_tmp "$ID" "$TASK_TMP" "$SPAWN_GENERATION_ID" here and in the equivalent managed rollback path at line 1802.

🔧 Fix: Harden rollback task temp cleanup
1 warning still open:

• ⚠️ tests/fm-account-routing.test.sh:1624 - The regression only greps for two exact source strings, so it never executes either rollback path or verifies the new fail-safe behavior when descriptor-pinned removal refuses. Use the existing task-temp failure hook to trigger rollback cleanup and assert that outside data survives and retry metadata is retained; otherwise control-flow regressions can pass this test unchanged.

🔧 Fix: Exercise rollback temp cleanup failures
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; uv run --directory tools/agent-fleet --locked pytest || rc=1; uv run --directory tools/agent-fleet --locked python -m compileall -q src || rc=1; exit "$rc"

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.