fix: preserve stable firstmate home identity

[coreldh]

Intent

Repair the second CI failure on existing PR #2222 by making every home-identity spawn refusal explain the exact identity relation, while preserving the refusal itself and prior pipeline fix commits. Update the existing branch and PR only; do not open a second PR, force-push, merge, or wait for CI after the PR step.

What Changed

• Introduce FM_HOME_IDENTITY as the stable owning-home path, preserving task-scoped backend labels when the installed code root moves.
• Refuse secondmate home and operational-directory identity overlaps (exact, ancestor, or descendant) with relation-specific error messages.
• Propagate the identity through spawned harnesses and teardown safeguards, with documentation and regression coverage updated accordingly.

Risk Assessment

✅ Low: The bounded change consistently carries the stable home identity through spawn, backend naming, and teardown checks, with explicit exact/ancestor/descendant refusal messages and matching regression coverage.

Testing

The baseline diff is clean; focused safety coverage exercised exact-relation messages for each home and operational-directory overlap plus pre-spawn terminal safety, and direct CLI transcripts confirm the end-user exact/ancestor/descendant refusal wording with no terminal action. The worktree remains clean.

Evidence: CLI refusal transcript

Exact, ancestor, and descendant home relations each exit 1 with the matching refusal text; terminal_action=none in all cases.

relation=exact exit=1
error: secondmate home cannot be the firstmate home identity: /var/folders/cq/xf4qcb9j0qzc2dbh173mflbm0000gn/T//fm-spawn-home-identity-transcript.zTRf0H/home-identity/primary
terminal_action=none
relation=ancestor exit=1
error: secondmate home cannot be an ancestor of the firstmate home identity: /var/folders/cq/xf4qcb9j0qzc2dbh173mflbm0000gn/T//fm-spawn-home-identity-transcript.zTRf0H/home-identity
terminal_action=none
relation=descendant exit=1
error: secondmate home cannot be inside the firstmate home identity: /var/folders/cq/xf4qcb9j0qzc2dbh173mflbm0000gn/T//fm-spawn-home-identity-transcript.zTRf0H/home-identity/primary/nested
terminal_action=none

Evidence: Focused safety test

ok - secondmate spawn preserves the relocated home-identity boundary

ok - secondmate spawn preserves the relocated home-identity boundary

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• git diff --check b5d430d6fdcd961ce9b681bf196f365c1825c284..602769121e862c817b6f8a102afce14d4f0f4bc5
• Focused execution of test_secondmate_spawn_refuses_home_identity_overlap from tests/fm-secondmate-safety.test.sh
• Direct bin/fm-spawn.sh … --secondmate checks for exact, ancestor, and descendant home-identity overlaps
• git status --short && git diff --check

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[coreldh]

Status refresh, verified live on 2026-08-12 at 17:07 UTC.

• Head: c7d05904ecfda1c2a055fbb6cb4d723e4cbf9f23
• Checks on that head: 14 check runs, all with conclusion success (Repo invariants, Lint shell scripts, Test coverage guard, Stock macOS Bash snapshot compatibility, Behavior timing aggregate, Behavior tests (Herdr), Behavior portable serial 1-4, Behavior portable parallel 1-2, PR must be raised via no-mistakes).
• Mergeability as reported by the API at that moment: mergeable: true, mergeable_state: clean.

Bounded purpose of this PR: introduce FM_HOME_IDENTITY as the stable owning-home path so home identity survives the installed code root moving, and refuse secondmate-home and operational-directory identity overlaps with relation-specific messages for the exact, ancestor, and descendant cases. The head above carries a follow-up correction to one refusal in that family that refused correctly but did not explain the relation.

No action is requested here; this is a state record only.