fix(bin): restore project-less remote seeding on macOS

[allstargg]

Intent

Repair Firstmate's remote project-less secondmate provisioning regression. The operator-facing path bin/fm-remote-home-seed.sh ... --no-projects must pass readiness, reach remote provisioning, and either publish a valid project-less home or roll back according to the injected remote outcome. Diagnose before assigning cause by separating the initiating trigger, any timing or fixture masking condition, and the visible early-exit symptom; compare with a successful project-bearing or equivalent remote seed path, inspect relevant history, test the smallest causal counterfactual, and seek disconfirming evidence rather than blaming the recently added parent binding. Implement the narrowest robust correction in the authoritative owner while preserving transactionality, remote unknown-completion handling, supplied-origin behavior, durable parent-binding publication order, and non-mutation of the local project tree. Turn the faithful lifecycle reproduction into executable regression coverage, including deterministic timing and concurrency assertions without sleeps that hide races. Validate the full remote lifecycle and parent-binding suites, all directly affected tests, shell lint, and documentation checks. Do not modify or rely on private secondmate-home parent records in the primary fleet. Drive no-mistakes through CI green and report the full PR URL.

What Changed

• Make project-less remote home seeding compatible with stock macOS Bash 3.2 by safely iterating an empty project array.
• Add deterministic lifecycle coverage for readiness, transactional rollback, and concurrent registry publication without timing sleeps that mask races.
• Exercise the project-less seed regression in the macOS compatibility CI job and document the expanded lifecycle coverage.

Risk Assessment

✅ Low: The Bash 3.2-safe empty-array expansion narrowly restores the project-less path while preserving project-bearing behavior, transactionality, readiness ordering, rollback semantics, and unknown-completion handling; the focused lifecycle coverage also replaces the affected race-masking delay with observable lock-wait synchronization.

Testing

Under Apple Bash 3.2, the operator-facing --no-projects path passed readiness and reached remote provisioning; deterministic contention exercised rollback and successful publication, while the full remote lifecycle, supplied-origin/non-mutation behavior, unknown-completion handling, durable parent-binding order, and trace-context suites all passed. CLI transcripts provide end-user evidence; no UI artifact applies to this shell-only change.

Evidence: Full remote secondmate lifecycle

ok - overlapping remote home provisioning serializes through publication and rollback
ok - remote seed rollback preserves serialized competing routes
ok - unknown readiness preserves its route and brief for reconciliation
ok - remote seeding checks, repairs, and re-checks readiness, then stops on a remaining gap
ok - remote seeding proceeds once the repair closes every gap
ok - remote seeding provisions a supplied origin without touching the primary project tree
ok - remote provisioning re-validates a supplied origin at the receiving host
ok - seeding carries bitbucket, self-hosted, and scp-like origins through to the remote clone
ok - remote seed registers the route and provisions the whole home and project clone on that host
ok - remote inheritance rejects incomplete and superseded payload generations
ok - mixed local and remote routes validate without migration
ok - remote spawn launches on the remote-local backend and records a host-qualified route
ok - legacy and mismatched remote endpoints fail closed before backend access
ok - non-herdr remote endpoints are refused without changing either route
ok - remote spawn serializes inheritance through launch publication
ok - marked send and routed reply complete through the existing parent correlation owner
PR_CHECK_MIGRATION: watcher ownership is ambiguous; review state/.watch.lock before rearming polls
ok - partial remote inheritance retains reread intent through bootstrap convergence
ok - config push and bootstrap serialize remote inheritance convergence
WARNING: watcher still down (same stale episode; last beat: 58s ago, grace 300s) - full banner already printed this episode.
WARNING: queued wakes pending - drain them with bin/fm-wake-drain.sh before anything else.
ok - remote inherited config retains and retries a failed live reread nudge
ok - fleet snapshot projects mixed local and remote structured state
ok - remote update imports and fast-forwards the persistent home on its configured host
PR_CHECK_MIGRATION: watcher ownership is ambiguous; review state/.watch.lock before rearming polls
ok - startup repairs remote readiness before probing without relaunching
PR_CHECK_MIGRATION: watcher ownership is ambiguous; review state/.watch.lock before rearming polls
ok - startup reports alive legacy backends without changing their routes
ok - unreachable remote state remains unknown with no local respawn or failover
ok - remote retirement refuses child work, then removes only its own endpoint while a shared-session sibling survives
ALL TESTS PASSED

Evidence: Project-less seed lifecycle

ok - overlapping remote home provisioning serializes through publication and rollback
ok - remote seed rollback preserves serialized competing routes
ALL TESTS PASSED

Evidence: Parent-binding lifecycle

ok - remote provisioning publishes durable parent state before its completion marker
ok - a remote secondmate's finished worker cleans up when the remote code root's own .env looked relay-active
ok - a remote secondmate's finished worker cleans up when only an ambient exported token looked relay-active
ok - a remote secondmate's finished worker cleans up with no relay signal anywhere
ok - a remote secondmate's own committed relay token still refuses cleanup
ALL TESTS PASSED

Evidence: Project-less trace-context lifecycle

ok - disabled: a remote-routed second mate records and receives no carrier and stays enabled-off end to end
ok - enabled: a remote-routed second mate receives one carrier in its pane, identical to the parent's recorded identity, before launch
ok - relaunch: a remote-routed second mate keeps one stable identity across restarts
ok - boundary: each remote-routed second mate roots its own trace and never adopts the spawning environment's carrier
ok - allowlist: the remote receiver accepts exactly the declared inherited-material set, including the enablement flag
ok - delivery: a parent-supplied carrier is accepted only for a secondmate launch and only as a strict W3C value
ALL TESTS PASSED

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Inspected git diff 70aeba855527f7693082f6dd1bc731e334d0269f..b4f97c5eb92d21694559810c5ab97916e1c0f768 and relevant history.
• Confirmed /bin/bash is Apple Bash 3.2.57, reproducing the affected runtime.
• FM_TEST_SEED_ONLY=1 /bin/bash tests/fm-remote-secondmate-lifecycle-e2e.test.sh
• /bin/bash tests/fm-remote-secondmate-lifecycle-e2e.test.sh
• /bin/bash tests/fm-remote-secondmate-parent-binding.test.sh
• /bin/bash tests/fm-remote-secondmate-trace-context.test.sh
• Verified git status --short remained empty after testing.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.