feat(bin): give the crew-state reader typed verdicts and freshness (land of upstream #1829)

[sbracewell64]

Lands the structured crew-state work (CFVC-05) onto the fork trunk.

The contribution exists upstream as kunchenguid#1829 (pipeline head 07599714). This branch was cut fresh from the fork trunk and carries only that contribution's own four commits; the upstream PR branch was left untouched.

What changes

• bin/fm-crew-state.sh: a structured --json mode emitting the reader's derivation as typed fields (state, source, detail, precedence_applied, busy_signal, run_step, terminal_error, evidence_age_secs) instead of only the human prose line. A cancelled run now reports aborted and a pipeline that broke without judging the work reports interrupted - both re-run conditions, previously flattened into failed, which told firstmate the change had been rejected and sent it to fix code nothing had criticised.
• bin/fm-classify-lib.sh: FM_CREW_STATE_VOCABULARY becomes the single owner of the verdict set, with crew_state_clears_open_decision and crew_state_absorb_class enumerating every member explicitly. Both return a distinct code for a verdict they were never taught, so a verdict added later cannot fall into the permissive branch by omission - which is how interrupted, stale, and idle silently cleared open decisions under the negative-condition chain this replaces.
• bin/fm-busy-lib.sh: a BUSY turn record past FM_BUSY_MAX_BUSY_AGE_SECS (default 3600) classifies stale record-expired rather than being reported as a live turn forever. stale and unknown stay distinct: evidence that aged out is a different answer from no evidence.
• bin/fm-fleet-snapshot.sh: consumes --json and projects the typed fields instead of re-deriving state/source/detail by splitting the prose line on its separators. A non-object read is rejected explicitly rather than being projected into an all-null object.
• Test suites for all of the above, plus tests/wake-helpers.sh serving both reader modes from one canned verdict.

Landing verification

Three-way merge screen against the fork trunk:

$ git merge-tree --write-tree fork/main HEAD; echo "exit: $?"
8c731e9384aceab8b323a67ca1e156a37b832f20
exit: 0
$ git rev-parse HEAD^{tree}
8c731e9384aceab8b323a67ca1e156a37b832f20

Merge result equals this branch's own tree, so nothing on the trunk is lost. The branch touches the same 13 files as the contribution's own diff.

Five conflicts were resolved against the current trunk. Three were adjacency-only (both sides adding neighbouring functions); the remaining two were real and resolved so the trunk wins wherever the contribution did not deliberately change it:

• crew_absorb_class (bin/fm-classify-lib.sh) - the trunk has evolved this past the version the contribution rewrote, gaining a settled class and an advancing-descendant-CPU fallback (fork fix(bin): detect child-process work during supervision (land of upstream #1676) #44). The contribution's deliberate change is the typed read and the vocabulary enumeration, not the removal of those sources. Resolved by keeping the trunk's structure and rewiring its shared read onto --json and crew_state_absorb_class, so both the trunk's extra evidence sources and the contribution's coverage gate survive.
• checks-passed handling (bin/fm-crew-state.sh, AGENTS.md) - the trunk corroborates that claim against the run's own CI log before repeating it (fork fix(bin): refuse merges without verified green checks (land of upstream #1614) #48). The contribution only changed the failed/cancelled arms, so the corroboration is kept intact alongside the new aborted/interrupted verdicts.

The contribution's upstream base carries Muse-adapter and Relay-rename work that the fork trunk does not have. Those lines came in through conflict context only, and were dropped rather than landed - this branch introduces no reference to either.

Test evidence

bin/fm-lint.sh - clean (ShellCheck 0.11.0, pinned 0.11.0), exit 0.

bin/fm-test-run.sh --changed --base fork/main - 84 scripts, 1567 passing checks, 9 failing, 2 gate skips:

FM_TEST_SUMMARY total=84 failed=10 skipped_gate=2 duration_ms=1408209

That summary reads 10 because it was taken before the last commit on this branch; the tenth was this work's own flaky row, fixed in 32ed351 and re-run 5/5 green (see below). The nine remaining failures are unchanged.

This work's own suites pass:

• tests/fm-crew-state.test.sh exit=0, 69 checks
• tests/fm-busy-state.test.sh exit=0, 22 checks
• tests/fm-fleet-snapshot-view.test.sh exit=0
• tests/fm-watch-triage.test.sh exit=0 and tests/fm-daemon.test.sh exit=0 - the trunk's own consumers of the rewired absorb path

Flaky row found and fixed. tests/fm-crew-state.test.sh passed on one full run and failed on the next with no code change between them:

not ok - conformance row failed -> expired busy record is stale:
  prose detail [... (7200s ago)], structured detail [... (7201s ago)]

The row compares the prose and structured renderings of one verdict but reads them through two separate reader invocations, and an expired-record detail embeds the age measured at read time - so a second boundary between the two calls renders the same correct answer one tick apart. 32ed351 normalizes the measured age on both sides; any other divergence in the detail still fails the row, and the age value keeps its own assertion against a single read. Five consecutive runs after the fix: run1..run5 exit=0, zero not ok.

Nine failures disclosed, all proven pre-existing on the base. A clean clone of ed376cf (this PR's base, none of these changes applied) fails all nine identically:

$ git clone <repo> /tmp/cfvc05-base && git -C /tmp/cfvc05-base checkout ed376cf
$ bin/fm-test-run.sh <the nine scripts>
FM_TEST_SUMMARY total=9 failed=9 skipped_gate=0 duration_ms=169050

suite	base ed376cf	this branch
fm-calm-pi-extension	exit=1	exit=1
fm-busy-adapter-wiring	exit=1	exit=1
fm-pi-watch-extension	exit=1	exit=1
fm-turnend-guard	exit=1	exit=1
fm-watcher-lock	exit=1	exit=1
fm-backend-tmux-smoke	exit=1	exit=1
fm-launch	exit=1	exit=1
fm-tmux-agent-liveness	exit=1	exit=1
fm-session-start	exit=1	exit=1

Gate skips (fm-pi-primary-types, fm-claude-stop-autoarm-live-e2e) are environment gates: Pi and a live Claude endpoint are not installed here.

CI state

The fork trunk's own CI is currently failing on main itself - the last five pushes to main all concluded failure. Checks on this PR are expected to be red for that reason rather than because of this change, and are not chased here. The local evidence above is what this delivery stands on.