feat(fleet): broadcast to marked agents across hosts

[jiunbae]

Follow-up to #125, closing the Fleet half of #101.

What it does

A Space mark in muxa fleet watch carries its host alias and full pane identity, so a local %1 and a remote %1 are two exact recipients rather than one ambiguous screen position. m freezes the set and gives every recipient its own ordinary durable request, sequentially — local through the controller daemon, remote aliases through their existing Fleet relay. Both yield a request id.

Remote authority is preflighted before the first request leaves: an observe-only host, or one missing collaboration / collaboration_get, is shown as will be refused and never called. A delivery failure stops nothing. Every recipient keeps a row with its request id, refusal or error; delivered agents lose their marks while refused and failed ones keep theirs for a deliberate retry.

Remote marking stays in muxa fleet watch rather than duplicating Fleet inventory inside muxa watch — the two are different TUIs, and the local one has no host axis.

Provenance and verification

Implemented by a codex agent working from a written brief in its own worktree; I verified it rather than taking the report:

• the commit touches three files (fleet_watch.rs, docs/FLEET.md, CHANGELOG.md), +901/−51 — no scope creep;
• cargo fmt --check, clippy --workspace --all-targets -D warnings, cargo test --workspace (1,801 tests) run by me on the merged branch, all clean;
• mutation-tested the new tests: deleting the observe-only refusal made broadcast_preflight_refuses_remote_observe_and_old_hosts_only and broadcast_dispatch_is_sequential_transport_aware_and_failure_tolerant fail, and restoring it made them pass. The tests bite.

The agent also corrected my brief: I had described both remote refusals as remote-only, but validate_fleet_collaboration_authority's capability loop applies to local hosts too. Local snapshots normally advertise both capabilities, so the broadcast path keeps the direct-local behaviour.

Note

The branch merged origin/main (nine commits) before this PR; only CHANGELOG.md conflicted. While resolving it I first filed this entry under the already-released 0.8.41 section and then briefly duplicated it — both corrected here, and the released section is unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AVQaf1oSAj6ZkgBg2uY2Gk