fix: merge-queue crashed on every pass decoding em-dash output (errors=replace + lint now enforces it)

[matt82198]

The queue was hard down

AesopMergeQueue (the 5-minute scheduled task that is the merge loop) exited 1 on
24+ consecutive passes, merging nothing while ~30 PRs piled up behind it.
From state/cron-merge-queue.log:

Exception in thread Thread-124 (_readerthread):
  File "C:\Python314\Lib\subprocess.py", line 1614, in _readerthread
    buffer.append(fh.read())
UnicodeDecodeError: 'utf-8' codec can't decode byte 0x97 in position 356: invalid start byte
Traceback (most recent call last):
  ... merge_queue.py, in build_batch
  ... merge_train.py, in git
    result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', timeout=120)
AttributeError: 'NoneType' object has no attribute 'strip'
MERGE-QUEUE: FAILED - exit 1

Root cause

Commit 2418634d ("add encoding=utf-8 to all subprocess calls") added encoding= to
62 call sites with no error handler. The shared git() / gh() transport therefore
decoded output strictly.

Git emits raw bytes from refs, config and commit messages without transcoding them, and
byte 0x97 — the cp1252 em-dash that queued PR titles and branch names are full of — is
not valid UTF-8.

The nasty part is where it fails. subprocess decodes captured output in a reader
thread, so the UnicodeDecodeError never reaches the caller's frame. It kills the
thread, result.stdout comes back None, and the next .strip() dies with a
meaningless AttributeError pointing at a line that looks perfectly fine. The crash
landed inside build_batch after the integration branch was created, which is also
why the deployed queue worktree is stranded off main.

The fix

errors='replace' on every decoding subprocess call on the daemon's traced call path:
the shared git()/gh() transport, plus the two regenerators the pass shells out to
(verify_test_suite_count.py, gen_tool_index.py). merge_queue.py's own
run_regenerator already had it.

replace, never ignore. ignore deletes the byte, silently turning a corrupted
branch name into a different, plausible-looking string that the queue then acts on. A bad
byte must stay visible as U+FFFD.

The guardrail gap (this is the real story)

Guardrail G10 mandated encoding='utf-8' but never an error handler, so
encoding_lint.py reported clean the entire time the queue was hard down. A rule a
linter does not enforce is how this shipped.

encoding_lint.py now flags any subprocess.run/check_output/Popen that sets
encoding= without a safe errors= handler. Allowed: replace, backslashreplace,
surrogateescape (all lossless or visible). Rejected: ignore (deletes data) and
strict (spelling the unsafe default out loud does not make it safe). G10's wording in
tools/CLAUDE.md, hooks/CLAUDE.md and driver/CLAUDE.md now matches what the linter
actually enforces.

Sweep: 74 more time bombs of the identical class

The new rule found 74 further sites across tools/ (44 files) and driver/. All are
fixed here rather than deferred — the pre-push hook runs this lint over the WHOLE repo and
fail-closes on any finding, so a rule the repo does not satisfy would block every
Python-touching push. Every edit is the same mechanical insertion of errors='replace'
beside an existing encoding=, applied by AST position.

Proof

Red-first, behavioral — a real git subprocess emits a real 0x97 byte (a git config
value written as raw bytes; git echoes it back verbatim). Reverting the fix:

FAILED test_gh_survives_undecodable_byte
FAILED test_git_survives_undecodable_byte
AttributeError: 'NoneType' object has no attribute 'strip'   <- the exact production error
tools\merge_train.py:236: AttributeError

A companion test pins the pre-fix behaviour (result.stdout is None on a successful
call) so the regression stays proven rather than merely asserted — if the fixture ever
stops reproducing the crash, that test fails and says so.

The real daemon pass, end to end. A pass with the fixed code checked out as main
executed build_batch — the exact function that was crashing — all the way through:
worktree_is_safe, fetch, integration-branch creation, 8 x (pr_view + fetch + merge),
the regenerators, push, batch-PR creation, labelling, and the try/finally tree restore.

merge-queue pass: ok
  - opened batch integrate/q-1785801893 with #717, #689, #696, #702, #703, #712, #716, #723
PASS_EXIT=0

That is PR #763, opened by the revived queue logic. Working tree left clean and on main.

Gates: python -m unittest discover -s tests green (the real CI command),
encoding_lint.py --check exit 0 repo-wide, secret_scan.py --staged exit 0,
claudemd_sync_gate green.

Deployment note

The live daemon runs from the worktree C:/Users/matt8/aesop-queue-main. Two things stand
between this PR and a working queue, and neither is fixable from inside this branch:

1. Bootstrap. The queue is what merges PRs, and the queue is broken — it cannot merge
   its own fix. This PR needs an out-of-band merge.
2. The deployed worktree is stranded, sitting on integrate/q-1785796683 rather than
   main (the crash escaped the except subprocess.TimeoutExpired containment, so the
   restore never ran). worktree_is_safe fail-closes on any non-main branch, so even with
   this fix it would refuse every pass until someone puts it back on main. Separately,
   the local main ref is 34 commits behind origin/main and nothing in the daemon
   fast-forwards it — so it also needs a pull before the fixed code is what actually runs.

🤖 Generated with Claude Code