Exclude controller from self fan-out, distinguish provision-failed reasons, fix ssh test stub arg capture

[twistedmelonman]

Summary

Three small, related tech-debt / design-question fixes to bin/lock-fanout and its tests.

• Investigate rapid self-lock loop on asiago observed during lock-guard's first live run #27 (self-exclusion only — scope narrowed per repo owner decision, see issue comment): lock-fanout now skips the controller if it appears in its own Synergy client list, logging client=<host> warn=skip-self instead of SSHing to itself. Comparison is against hostname -s + .local, lowercased, matching list-clients' output format. The osascript-permission-check follow-up idea from the same issue is explicitly not implemented here — left for a possible future issue if the original burst recurs.
• SSH test stub only captures first positional arg after user@host #28: Fixed tests/lock-fanout.bats's make_ssh_stub arg parser, which only kept the last unmatched positional arg after user@host (silently dropping any earlier ones for a hypothetical multi-arg remote command). It now accumulates all trailing positional args, space-joined. No currently-passing test's behavior changes, since all current call sites pass the remote command as one quoted string.
• warn=provision-failed does not distinguish unreachable client from missing shasum #29: provision_host now reports why it failed via provision_fail_reason (missing-local-lock-guard or ssh-failed) and provision_fail_rc (the actual ssh exit code, only set for ssh-failed). fanout_host's warn=provision-failed log line now includes reason=<...> and, for the ssh-failed case, ssh_exit=<rc> — mirroring the field already present on the fallback pmset line.

CLAUDE.md and README.md updated where their wording was no longer accurate after these changes (the "SSH-to-self is a no-op — do not special-case it" line now needs the fan-out-level exception called out).

Closes #27
Closes #28
Closes #29

Test plan

• bats tests/ — 66/66 pass, including 7 new tests (3 self-exclusion, 1 ssh-stub regression, 2 provision-failed reason, plus doc/wording is covered by existing suite)
• shellcheck -S info bin/* — clean
• npx markdownlint-cli '**/*.md' — clean
• Local code-reviewer + adversarial-reviewer hooks — both PASS on commit
• Pre-push full-diff + codebase review — both PASS

Claude-Session: https://claude.ai/code/session_01GBtkU7NAZXszj4MyLFpi6V

[claude]

No blocking issues found.

• local_host computed at script load: if hostname -s fails, value becomes .local and no real host matches, degrading to never-skip (prior behavior). Safe.
• provision_fail_reason/provision_fail_rc globals are reset at the top of every provision_host call and read synchronously by fanout_host after return. No stale-value leak possible.
• Self-exclusion logic, provision-failure reason tagging, and SSH stub multi-arg fix all look correct.

VERDICT: PASS