feat(meta-mode): harden portable workflow tooling

[3metaJun]

Problem

mstack's long-running workflow support still had portability and durability gaps. Worktree cleanup depended on Unix shell tools, resume state lacked a durable portable checkpoint, shipping verdicts were not structurally tied to patch identity, and several pstack safety mechanisms were missing or implicit.

Scope

• Add a Node.js worktree audit with safe NUL-delimited Git path parsing and retain the shell wrapper for compatibility.
• Add Git-bound durable resume checkpoints with atomic begin, publish, and read operations.
• Bind orch verification verdicts to PR, head, base, branch, patch-id, verifier, and runtime evidence.
• Add Harness-neutral deadline, landing revision, guarded merge, and command transport helpers.
• Add an explicitly selected session-context artifact without installing implicit hooks.
• Extend project playbook validation with structured JSON, strict mode, warning severity, duplicate extends checks, and anchor diagnostics.
• Close review findings for resume ID traversal and malformed landing revisions.

Verification

• npm test with 245 passing tests.
• node --test tools/meta-mode/resume.test.mjs tools/meta-mode/pr-safety.test.mjs with 8 passing tests.
• node scripts/validate.mjs.
• node scripts/skill-baseline.mjs --check.
• node tools/meta-mode/check-playbooks.mjs ..
• npm pack --dry-run --json.

Known limitation: Bun-specific orch tests were not runnable in this environment because Bun is unavailable. The integrated Node/npm suite passed, and the limitation is recorded in the implementation report.

---

Agent: GPT-5 via pi