fix(ci): verify a head-bound attestation instead of PR body text (land of upstream #1825)

[sbracewell64]

What this is

A landing, not a new fix: it carries upstream PR
kunchenguid/firstmate#1825
onto this fork's trunk so the running fleet actually gets the head-bound
attestation check. Nothing was redesigned and nothing was re-reviewed.

The Require no-mistakes check used to grep -qF a literal marker string
against the pull request body - a mutable, author-controlled text field
bound to no commit and satisfied by anyone who typed the string. It now
verifies a git note on refs/notes/no-mistakes that names the exact head
commit, so it cannot be copied from another pull request and does not survive a
rebase, an amend, or a force-push.

upstream PR	kunchenguid/firstmate#1825
head commit	f1e63a13f6ae89bd18c5f796e487593513c03f4d
its base	2cf0283b811e81a821cddf5b7f74e1f7de8e2881
landed onto	ed376cf (sbracewell64/firstmate main)

Contribution kunchenguid#1825 stays open and untouched upstream, on the maintainer's own
schedule. Nothing in this branch was pushed to kunchenguid/firstmate.

The contribution's head is f1e63a1, three pipeline-review commits past the
e04fc24 named at intake. The whole contribution is carried, not a prefix.

Reconciliation

The two trunks diverged at upstream kunchenguid#1495, so the diff did not apply cleanly.
Every resolution below is fork-versus-upstream divergence, not a change to what
kunchenguid#1825 does.

• bin/fm-timeout-lib.sh - carried verbatim from upstream 2cf0283 as a
  required dependency, not as a separate improvement. fix(bin): verify a head-bound attestation instead of PR body text kunchenguid/firstmate#1825 deliberately
  moves the bounded axi status read onto that owner, and
  tests/fm-attest.test.sh sources it and calls fm_run_timed directly, so the
  only alternative was to rewrite the reviewed code and its tests. On this trunk
  bin/fm-nm-run-lib.sh is its only caller; upstream also has four others that
  do not exist here.
• bin/fm-test-run.sh - the pr-forge case keeps this fork's
  fm-merge-local.test.sh alongside upstream's added fm-attest.test.sh. The
  bin/fm-timeout-lib.sh selection case is carried with the fork's caller
  set named instead of upstream's, because session start, the fleet/bearings
  snapshots and the vendor auth probe do not source it on this trunk; it selects
  the same families bin/fm-nm-run-lib.sh does. Upstream's adjacent
  bin/fm-sessionstart-run.sh case is left behind, as that script does not
  exist here.
• tests/fm-backend.test.sh - this fork's sibling list is the base, with
  fm-timeout-lib.sh added in upstream's position. The fork's own
  fm-landed-lib.sh, fm-launch-lib.sh and fm-admission-lib.sh stay, and
  upstream's fm-secondmate-parent-lib.sh is not added: neither trunk's set is
  a subset of the other.
• docs/documentation-audiences.json - both entries kept in path order,
  this fork's docs/launcher.md and upstream's new
  docs/no-mistakes-attestation.md.
• docs/scripts.md - upstream's fm-attest.sh row and its
  fm-nm-run-lib.sh rewording, plus a fm-timeout-lib.sh row for the
  dependency carried above.

Delivery disclosure

This shipped direct-PR, without the no-mistakes pipeline. It carries no
attestation marker and no attestation note, and it has had no automated
review. The attestation it adds is deliberately absent from its own head:
writing one for work the pipeline never validated would forge exactly the
evidence this change exists to make unforgeable.

What was verified, and how:

Check	Result
bin/fm-lint.sh	clean, under pinned ShellCheck 0.11.0
bin/fm-doc-audience-check.sh	ok, surfaces=73 local_links=215
tests/fm-attest.test.sh	43 assertions pass
tests/fm-backend.test.sh	28 pass
tests/fm-crew-state.test.sh	54 pass
tests/fm-teardown.test.sh	68 pass
tests/fm-test-run.test.sh	17 pass
tests/fm-gotmp.test.sh	3 pass

The decisive control was witnessed, not assumed. With the structured parse
replaced by the honour-system substring match this contribution removes,
tests/fm-attest.test.sh reports:

not ok - the replaced honour-system marker was accepted as an attestation

and with the landed code the same case passes. refuse() was separately
neutralized to exit 0 and the suite failed on its first case, so the suite is
not passing by absence of signal. Both edits were reverted and the files
compared byte-for-byte against their originals before committing.

Two failing checks, neither caused by this branch

This PR is red, and it is not being presented as green. Both failures
pre-exist on the base and neither has been silenced.

1. PR must be raised via no-mistakes - expected and correct. This ships
direct-PR, so there is no attestation to find, and the check refuses. See the
disclosure above: the marker was not and will not be written.

Evidence it is not new: the three most recent landings on this trunk carry the
same refusal on their heads -
#48 (9ac06bb),
#49 (14e255c),
#50 (2a54197).

2. Behavior portable serial 2 - a pre-existing trunk failure, untouched
here.

Evidence it is not new: the base commit's own push run fails it before this
branch exists -
run 31068554687
on ed376cf, where Behavior portable serial 2 is the only failing job and
Run portable serial shard 2 the failing step. Its summary reports
FM_TEST_SUMMARY total=23 failed=1 with the single failure in
family=secondmate - a family this branch touches no file in. The same job
fails on the heads of #48, #49 and #50 above.

No attempt was made to fix it: the upstream fix shards that lane and this fork
is behind it, which is a separate resync.