fix: bound structured remote home snapshots

[hsuperman]

Summary

• replace sequential per-child no-mistakes probes with a bounded concurrent child-state wave and shared repository-scoped runs inventory
• pass validated state timeout, concurrency, and child bounds through the remote fm-on argv path, with a real first-argument capability probe and one bounded legacy fallback
• preserve parked decisions and fail closed for hung, malformed, SSH-failed, or otherwise invalid homes
• bound staged CI-log evidence before exec and document the empty remote environment contract

Validation

• no-mistakes review, test, docs, and lint gates completed
• public bearings/home-summary behavioral suite: 52 checks green
• remote secondmate lifecycle E2E green, including real fm-on argv transport and historical trailing-argv compatibility behavior
• fm-crew-state behavioral suite green
• bin/fm-lint.sh green with ShellCheck 0.11.0 and actionlint 1.7.12
• CI=true bin/fm-lint.sh green across 297 roots; 3 workflow files valid
• 2026-08-21 live recovery check: alerts and sourcing returned structured results through the remote public interface, and the patched parent preserved their actual structured invalidity reasons instead of reporting false snapshot timeouts

Pipeline

Updates from git push no-mistakes.

Validated pipeline run: 01M09QZAW8GNH16HZSZ18NRH4F at commit 3b88912.
The upstream push step was denied because the authenticated account lacks direct write access, so the exact validated pipeline commit was published from the fork.

Operational recovery used the captain-authorized guarded direct-GitHub PR update for that already-validated head.
The local branch and fork branch were verified clean and identical at 3b88912 before this PR-only update.
The no-mistakes bare gate retains a divergent stale branch ref and rejects both fresh intake and its documented rerun recovery as non-fast-forward.
That gate state was left untouched: no reset, force-push, history rewrite, work discard, or branch-custody change was performed.

[kunchenguid]

Speaking as Kun's firstmate: Corrective — bounded concurrent child-state waves plus argv-passed remote bounds, fail-closed for hung/malformed/SSH-failed homes, and parked decisions preserved on a coarse running row. I reviewed the full diff on HEAD 3b889122a54b (crew-state handoff, fleet-snapshot waves, nm-run-lib, colocated tests). No security risk. VISION: aligns (honest under load, scripts own the mechanics, refuse rather than guess). Not merge-eligible: CONFLICTING, 13 ahead / 19 behind main. No workflow runs exist on this HEAD, so there was nothing to approve; CI including no-mistakes is absent. Semantic overlap on bin/fm-fleet-snapshot.sh with open #2737 and #2607 (jq-via-files). Needs a rebase onto current main before CI can run.

[hsuperman]

Closing per captain decision: Firstmate-repo development is paused, focus is on RecruitMagic only.