fix(fleet): retry-safe Gitea onboarding and boundary regressions

[Futuri-Risk]

Human summary

The Gitea onboarding path now gets through native Secondmate provisioning and real tasks-axi backlog import, including safe retries.
The focused cloud behavior step passes on the exact head below.
This remains a draft integration change for #2, not completion of the whole fleet or permission to cut over production.

Changes

The prerequisite charter fix, 7580d5f, is already on feat/gitea-acpx-fleet.
It scaffolds a durable native Secondmate brief before home provisioning, preserves an existing charter/routing scope, rejects incomplete or symlinked charters, and prevents ambient native path overrides from targeting another home.
This PR adds the regression coverage and fixes tasks-axi's positional import contract.
Imported titles retain their source issue number and cannot become CLI options.
Structured stdout errors are no longer lost behind an empty stderr or a runtime warning.
Complete errors are redacted before truncation, preventing a partial credential tail from leaking across the message-size boundary.
The Gitea repository request uses its canonical non-redirecting endpoint and rejects malformed repository identity responses.
The fleet suite runs through the canonical FirstMate test runner; full lint and inventory/documentation checks are separate from behavior success.

Exact-head cloud evidence

Focused behavior evidence remains from head 0cbb8e0aaac8e3f1b20890cc26d1ec50010e3030: all 27 focused behavior tests passed.

The repository-wide lint failure on that run was isolated to two ShellCheck findings:

• SC1007 in bin/fm-acpx-lib.sh for implicit empty local initializers.
• SC2015 in bin/fm-spawn.sh for an A && B || C dependency guard.

Both are corrected on the current head d1c08ea44c6a5b42f2b98d212b590dc196a6be99:

• ACP probe locals now use explicit empty-string initialization.
• The ACPx/Python prerequisite check now uses an explicit if block.

Automatic fleet validation remains enabled.
The active integration branch now supersedes stale runs when a newer commit arrives instead of disabling CI, and the fleet contract workflow includes canonical lint so ShellCheck defects are caught as part of branch validation.
Dependency evidence and Windows/tmux compatibility also remain automatic; latest-head concurrency is used where appropriate to reduce duplicate stale-run noise without suppressing current-head failures.

What the tests prove and do not prove

Onboarding exercises real Git, real tasks-axi and native FirstMate brief/home provisioning against a local HTTP repository fixture.
It checks one persistent home across repeated onboarding, open-versus-closed issue import, preservation of project instructions, dirty/untracked files, existing custom charters, incomplete-charter repair/retry, wrong origins, symlinks and cross-home environment isolation.
The no-mistakes init/doctor double isolates provisioning side effects; it is not a review attestation.
The ACP tests use the real ACPx executable with a deterministic local ACP peer, not a live ZCode model account.
The email tests use a local TLS SMTP peer, not production SMTP.
No independent no-mistakes review or live Windows/OpenCode/ZCode/production-Gitea certification is claimed.

Remaining acceptance and coordination

Keep #2 open: mirror freshness/preference edge cases, default start/restart behavior and direct Secondmate conversation with parent-channel reporting still need complete acceptance evidence.
The full multi-project fleet acceptance in #11 and the other implementation tickets are not closed by this patch.
Before merging the integration branch to main, reconcile the fleet suite's dependency/classification with the normal CI lanes, complete canonical checks, and obtain the required exact-head no-mistakes evidence.
The temporary fleet-native-patch.py and its workflow on the integration branch overlap the error/endpoint changes and include separate mail fixes; reconcile those intentionally rather than replaying the old helper over this head.
Concurrent changes were observed on feat/gitea-acpx-fleet, which is why this work is isolated on fix/fleet-onboarding-contracts.
No force push, main merge, old Forge migration, production credential change or workstation deployment has been performed by this continuation.