fix(bin): gate no-mistakes done-line check on the line's own URL, not recorded pr=

[cm-maple7]

Intent

Follow-up fix on top of the done-drift PR: fm-status-append.sh's guard required state/.meta's pr= to already be recorded before allowing a done: line, but firstmate only writes pr= (via fm-pr-check.sh) after seeing the worker's own done: PR checks green report, so the guard could never be satisfied by a legitimate first report and refused every real completion. Gate on the line's own content instead: accept a done: line on a mode=no-mistakes ship task only when it names a real http(s) URL (the DOD's one prescribed final-done shape), refusing everything else including the retired done: {summary} wording. Also fixes the pipeline's own promoted-worker regression test in tests/fm-task-delivery.test.sh, whose sed-style backslash-escaped test URL was left as literal backslash characters by bash parameter substitution rather than a real https:// prefix, so it only passed under the old meta-only check. Update tests/fm-status-append.test.sh to match the corrected behavior and add coverage proving a recorded pr= does not exempt a URL-less done line.

What Changed

• Add bin/fm-status-append.sh, a guarded status-append helper that only refuses a done: line on a mode=no-mistakes ship task when the line itself names no real http(s):// URL (rejecting the retired done: {summary} wording), instead of requiring a pr= that firstmate can't have written yet at that point.
• Wire the guard into the delivery path: bin/fm-dod-lib.sh gains fm_status_report_line/fm_status_report_guard_note helpers that render the correct status-report command per mode, consumed by both bin/fm-brief.sh (fresh briefs) and bin/fm-promote.sh (promoted scouts), so a promoted no-mistakes worker gets the same guarded command as a briefed one.
• bin/fm-crew-state.sh reclassifies a no-mistakes ship task's unattributed done: status line as parked (not terminal done) when no validated pr= is recorded, prompting a run of /no-mistakes instead of reporting false completion.
• Fix the pipeline's own promoted-worker regression test in tests/fm-task-delivery.test.sh (its test URL was left as literal backslash characters instead of a real https:// URL, masking a check that only passed under the old meta-only guard); update tests/fm-bearings-snapshot.test.sh's done fixture and add tests/fm-status-append.test.sh plus new tests/fm-crew-state.test.sh coverage proving a recorded pr= does not exempt a URL-less done line.

Risk Assessment

✅ Low: The commit correctly fixes the identified bug (gating on meta pr= made the guard unsatisfiable for a legitimate first report), is internally consistent across fm-brief.sh, fm-dod-lib.sh, fm-status-append.sh, fm-promote.sh (via the shared helper), docs, and tests, and the regression test's backslash-escaping bug is genuinely fixed; the only gap found is a minor substring-match looseness with no realistic exploitation path given the guard's purpose (a mechanical backstop against a cooperative LLM worker's known bad phrasings, not an adversarial boundary).

Testing

Both targeted test files (fm-status-append.test.sh and fm-task-delivery.test.sh) pass in full under the target commit, and I independently reproduced the pre-fix bug (a legitimate first done report with a real PR URL was wrongly refused because meta's pr= wasn't recorded yet) and confirmed the fix resolves it end-to-end by running the pre-fix and post-fix versions of fm-status-append.sh side by side against identical inputs; I also reproduced the sed-style backslash-escape defect in the old promoted-worker test and confirmed it would have failed under the new content-based gate, validating that the test correction in this commit is a genuine regression fix rather than a tautological source-grep. No issues found.

Evidence: fm-status-append.test.sh full run (9/9 pass)

ok - fm-status-append.sh: bash -n succeeds
ok - fm-status-append.sh: refuses a premature no-mistakes done that names no PR URL
ok - fm-status-append.sh: refuses the retired done: {summary} wording
ok - fm-status-append.sh: allows a nonterminal working: line on a no-mistakes task
ok - fm-status-append.sh: allows a done: PR <url> ... line with no pr= recorded in meta yet
ok - fm-status-append.sh: a recorded pr= does not exempt a done line that names no URL
ok - fm-status-append.sh: direct-PR and local-only tasks are never gated on a recorded pr=
ok - fm-status-append.sh: a missing meta file never gates a done line
ok - fm-status-append.sh: every non-done verb always passes through unguarded
all fm-status-append tests passed

Evidence: Repro: pre-fix code refuses a legitimate first done report naming a real PR URL (the exact bug the intent describes)

=== OLD behavior: legitimate first done report (no pr= recorded yet) with a real URL in the line ===
refused: this is a mode=no-mistakes task, so "committed, gates green" is not done.
Run /no-mistakes now and respond to its gates until it reports CI green, then
report done as: done: PR {url} checks green
exit code: 1
status file exists: no

=== NEW behavior (fd34cfe): same legitimate first done report ===
exit code: 0
status file contents:
done: PR https://github.com/x/y/pull/9 checks green

Evidence: Repro: old test's sed-style backslash-escaped URL produces literal backslashes, which the new content-based gate correctly rejects

Resulting command string:
fm-status-append.sh statusfile.status "done: PR https:\/\/github.com\/x\/y\/pull\/1 checks green"

=== NEW gate against the OLD test's malformed backslash-escaped line ===
refused: this is a mode=no-mistakes task, so "committed, gates green" is not done.
...
exit code: 1

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 info

• ℹ️ bin/fm-status-append.sh:54 - The gate accepts any done: line containing the bare substring "http://" or "https://" anywhere, with nothing required after it (e.g. "done: http://" or "done: see https:// for context" both pass). This is a looser check than "names a real http(s) URL" as stated in the comment and commit message. In practice this only matters against a cooperative LLM worker deliberately trying to game the exact prescribed DOD wording, not an adversarial input, so the risk is low, but a minimal tightening (e.g. requiring at least one non-whitespace character after the scheme, such as *http[s]://?*) would make the check match its own documented contract exactly.

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-status-append.test.sh (9/9 pass, including the two new tests test_refuses_the_old_dod_summary_wording and test_recorded_pr_does_not_exempt_a_urlless_done_line)
• bash tests/fm-task-delivery.test.sh (11/11 pass, including test_promoted worker guarded exactly like a fresh brief's)
• Manual repro: extracted bin/fm-status-append.sh@23f58af (pre-fix) into /tmp and ran it against a fresh state/<id>.meta with kind=ship, mode=no-mistakes, no pr= - confirmed a done: PR https://github.com/x/y/pull/9 checks green line was wrongly refused (exit 1)
• Manual repro: ran the same scenario against bin/fm-status-append.sh@fd34cfe (fixed) - confirmed the same line is now accepted (exit 0) and appended verbatim to the status file
• Manual repro: reconstructed the old test's bash parameter-substitution replacement string in isolation and showed it yields literal backslash characters ('https:\/\/...'), then fed that malformed string to the new gate and confirmed it is correctly refused - validating why the test needed the unescaped-URL fix

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.