v3 workflow: intent, phases, review, submission, enforcement, burn-in

The v3 stack, previously an uncommitted working tree, plus this session's two
units and the burn-in instrument. This commit is the burn-in build identity:
coordinator and worker must both report this revision before a task is created.

Workflow (earlier sessions, uncommitted until now): human decision events and
reduction, source cursors and reconcile-before-launch, turn-boundary
reconciliation, internal/agentctx as the single renderer, ace-fca phases with
sealed artifacts, the trajectory gate, bounded grilling, independent review,
task pr enforcement, and human review reflection.

Capability restrictions at the agent boundary: an authz.Agent surface at
GatedWrite may ask and may not act. It also fixes two bugs the unit exposed --
gated surfaces could not reach the two endpoints written for them, and
RequestHumanDecision would block an unowned task while rejecting a question
from the session that did own it.

Turn-boundary reconcile-failure escalation: a streak of consecutive failures
asks the session to hand off, fenced on the lease epoch, with reconcile_failure
as a real handoff reason. The worker was dropping the coordinator's verdict on
the floor; it now acts on it.

Burn-in: herdr.WriteLaunchContext dumps the exact agentctx.Build result to
<worktree>/.orchestra/launch.md at every launch, local and federated. BURNIN.md
is the runbook. deploy/build.sh stamps both binaries from one commit.

go build, go vet and go test ./... pass, 20 packages.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/federation/federation.go

@@ -27,12 +27,13 @@ type Worker struct {
 	Token             string         `json:"-"`
 }
 
-// WorkerHealth is reported by the worker that owns the local herdr socket.
+// WorkerHealth is reported by the worker that owns the local execution backend.
 // It intentionally does not reuse coordinator TCP-probe state: a remote
-// socket is meaningful only from the machine where the worker and checkout
-// live.
+// pane backend is meaningful only from the machine where the worker and
+// checkout live. HerdrStatus keeps its wire name for compatibility.
 type WorkerHealth struct {
-	HerdrStatus string    `json:"herdr_status"` // reachable, unreachable, or unknown
+	Backend     string    `json:"backend,omitempty"` // herdr or tmux
+	HerdrStatus string    `json:"herdr_status"`      // reachable, unreachable, or unknown
 	CheckedAt   time.Time `json:"checked_at,omitempty"`
 	ActiveTask  string    `json:"active_task_id,omitempty"`
 	ActivePane  string    `json:"active_pane_id,omitempty"`
@@ -422,7 +423,8 @@ func (r *Registry) Available(id string) bool {
 	}
 	// A heartbeat merely proves the worker process can reach the coordinator.
 	// Lease admission additionally requires a fresh probe of the worker's
-	// local herdr; otherwise a partitioned/down herdr still attracts work.
+	// local execution backend; otherwise a partitioned/down backend still
+	// attracts work.
 	w.Online = time.Since(w.LastSeen) <= r.TTL && w.Health.HerdrStatus == "reachable" && !w.Health.CheckedAt.IsZero() && time.Since(w.Health.CheckedAt) <= r.TTL
 	r.workers[id] = w
 	return w.Online