Worker template and runtime checkpoints stage with 'git add -A', sweeping out-of-scope stray files into lane commits (two batches running) #663

Report

Two batches in a row, stray files outside a task's File Scope were swept into lane commits by git add -A, and each
time the supervisor had to write a cleanup commit before the wave merge (penster):

• Batch 20260914T182512, TP-2055: a zero-byte root file empty (a shell-redirect artifact) was staged by the
  worker's git add -A in a hydrate: commit (8344c2cf); it blocked the wave merge and was removed in 48fbcbbf.
• Batch 20260916T164502, ALL THREE lanes: a supervisor-placed, lane-local note .pi/standing-ruling-v2-batch4.md
  was swept into worker commits on every lane — hydrate: commits on lanes 1 and 2 (53086a13, eb21b513) and a
  hold(TP-2056): commit on lane 3 (f9426584). Cleanup commits eaf4a228 and a54f1889; lane 1 still pending at the
  time of writing.

Three surfaces stage with -A:

1. The worker template tells workers to commit with git add -A && git commit … at every step / hydrate / hold
   (templates/agents/task-worker.md:168,192,194,236,259,343).
2. The runtime's post-task checkpoint: commitTaskArtifacts runs git status --porcelain then git add -A
   (extensions/taskplane/execution.ts:575), commit message checkpoint: <task> task artifacts (.DONE, STATUS.md).
3. The merge safety-net (engine.ts:4242).

completion-authority.ts:115 and resume.ts:546 already name the risk ("uncommitted source changes that the
post-task git add -A would sweep into …"). The runtime HAS the packet's File Scope: discovery.ts:741-796 parses
## File Scope into fileScope: string[].

Expected

• Worker template: stage by path, never -A: git add <files you changed> && git commit …, with the rule "a
  path outside your File Scope is never staged; if you created a file you did not intend, delete it before
  committing". Keep git commit -am only for the STATUS.md-only commits.
• Runtime checkpoint (commitTaskArtifacts) and merge safety-net: stage taskplane-tasks/<task>/** (STATUS.md,
  .DONE, .reviews/) plus paths that match the task's parsed fileScope — never -A. Anything else left in the
  worktree is reported, not committed: one Checkpoint skipped <n> out-of-scope path(s): … line in STATUS.md's
  Execution Log and in the lane log, so the supervisor sees it before the merge instead of the merge failing on it.
• Optional config: taskRunner.worker.checkpointStaging: "scope" | "all" (default "scope") so a project that
  deliberately relies on -A can keep it.
• Lane-local supervisor files: a documented location (.pi/lane/ or .pi/supervisor/) that is git-ignored by the
  project template's .gitignore block, so a note the supervisor drops into a lane worktree can never be committed.

Acceptance

• Behavioural test: a worktree containing an out-of-scope stray file + in-scope changes → checkpoint commit contains
  only the in-scope paths and the task folder; the stray file remains untracked; the Execution Log carries the
  "skipped out-of-scope" line.
• Template test: task-worker.md contains no git add -A.
• Merge test: a lane whose worktree carries an untracked out-of-scope file merges cleanly (the safety-net does not
  stage it) and the lane log names the file.