Harden swarm authority and delivery gates V2

[Ridgeio]

Scope

This is a clean successor to #18, based on the actual target feat/swarm-next-v1 at ef91f8f70ef23f2604c97f4c85f6b3bef7f4ca4a. PR #18 head bf9cf8c7cdf1db2cc6362ffc095480b73d72e604 was adjudicated commit-by-commit; its four foundation commits are preserved here rather than overwriting that PR.

This successor adds the missing V2 enforcement:

• Owner/Lead-only protected grants and decisions
• atomic two-phase handoff delivery with source ownership retained until exact acceptance
• non-acking inbox display, refusal of bulk acknowledgement, and exact single-message ack
• mandatory repository/worktree/head/tree and immutable author-family identity for code tasks
• live-qualified, typed exact-head review requests/verdicts with source, reviewer, task-epoch, and invocation binding
• exclusive task-epoch-bound migration resource leases
• exact process-tree stand-down with PID-reuse protection and verification before unregister
• deterministic test background suppression for detached redelivery workers

Causal evidence

tests/authority-delivery-hardening-v2.test.ts attacks the Wave 0 failure modes directly, including worker self-grants and hostile decision supersession, crash/dead-recipient handoff, non-acking/bulk-ack refusal, author-family laundering and self-review, expired/drifted/stale review identity, verdict replay across task epochs, fake-report override bypass, concurrent migration reservation, and unrelated/PID-reused process preservation during stand-down.

Verification

• npm run build — pass
• npm test — 325/325 pass across 65 suites
• focused hardening + handoff run — 15/15 pass
• git diff --check — pass
• secret-shaped-content scan — no findings

Candidate head: ef01710f6b48439d6ee786c629104ba05446426b

Candidate tree: c51c8e3d53455728906a70b0679a0770fb21a714

Evidence ceiling

Not established: a binding live-qualified external review verdict. Current reviewer qualifications in the running installed swarm are expired, so the durable task remains checkpointed rather than falsely closed. This candidate was not installed, merged, deployed, or exercised against Prompt Eden application or production state.