#758 Make branch merge decisions recoverable, replayable, and CI-enforced

Summary

• persist clone-local, recoverable merge decision receipts while committing only privacy-safe hashes and provenance
• expose SDK primitives plus pm merge report, and reconcile both drifted and already-clean branch merges into addressable merge_reconcile history events
• pin clone-local Git drivers to absolute Node/CLI paths, pass the real %P item path, and diagnose missing or drifted driver configuration
• enforce strict storage and history-drift validation across every tracker stream in CI, backed by a non-representative corruption negative control
• prove randomized N-branch merge-order convergence and document the full installed-package workflow

PM lineage

• pm-c0wthb
• pm-9j2r3b
• pm-rh98vo
• pm-76dnfg
• pm-pdr8t1

Closes #754.

Verification

• full sandboxed suite: 376 files, 6,437 tests
• coverage: 100% statements (44,398/44,398), branches (31,515/31,515), functions (9,082/9,082), lines (43,135/43,135)
• lint, zero-duplicate scan, 100% docstring/static quality, SDK surface/import/transport ratchets, docs/skills, secret scan, npm audit, compatibility, packed npx, and 88-command package-first dogfood
• installed npm/npx/bunx consumer proof with a real two-branch scalar conflict, receipt report, reconciliation, and strict history/storage validation
• live tracker validation: 2,117 items and 2,128 history streams with zero drift, duplicate IDs, configuration failures, driver drift, or pending receipts
• Sentry 14-day gate: zero critical and zero high events; telemetry flush confirmed

---

Summary by cubic

Makes branch merge decisions auditable and replayable by storing clone‑local merge receipts, adding pm merge report, and reconciling merges into addressable history. Pins and audits absolute Git merge drivers with real %P paths and enforces repository‑wide history drift in CI; fixes fence‑fails‑open and makes GH‑754’s conflict reports durable. Closes #754.

• New Features

  • Persist merge decision receipts locally; add pm merge report and audited pm merge reconcile to write privacy‑safe merge_reconcile events.
  • Pin Git drivers to absolute CLI paths and pass %P; validate/health now audit driver config and surface pending receipts.
  • CI installs drivers in fresh clones, verifies the committed .gitattributes fence is reproducible, validates all history streams with --check-history-drift, and runs these checks without extensions; adds randomized N‑branch convergence tests.

• Bug Fixes

  • Write receipts only after successful output writes; merge reconcile distinguishes receipt‑only reconciliation from actual history repair.
  • Align validate with health workspace discovery to audit driver configuration and pending receipts consistently.
  • Strengthen CI’s negative control so a clean representative smoke cannot mask drift elsewhere.

• Migration

  • Re‑run pm merge install in each clone to refresh driver commands.
  • After merges, run pm merge report and pm merge reconcile (or let CI handle it) to capture receipts and reconcile history.