feat: land the revision-preflight guard, fixed and wired into contract execution

A contract verdict is only meaningful if it came from the merged copy. The
fleet has been bitten three times on 2026-09-25 (a clone parked on a merged
feature branch while executing from another clone; a script copied into the
runner clone by hand; a stale local origin/master making an ancestry check
report unlanded work). The control for this existed as an untracked draft and
protected nobody, because it was entirely fail-open.

Defect in the draft, preserved verbatim as tests/fixtures/revision-preflight.prefix.sh:

  git -C "$CLONE" show "origin/master:$(basename "$SCRIPT")"

basename drops the scripts/ prefix, so for any script under scripts/ it queried
the repo root, failed, took the "warn but don't block" branch and exited 0 -
passing a script that exists in no revision at all. Reproduced:
  pre-fix + scripts/demo.sh under scripts/  -> 'could not resolve', EXIT=0
  pre-fix + a script in no revision          -> EXIT=0

Fixed guard (scripts/revision-preflight.sh):
* resolves the repo-relative path inside the clone, so scripts/ paths resolve;
* FAILS CLOSED - a path absent from the ref, an unresolvable ref, or a failed
  fetch is a failure, never a warning;
* fetches the remote by default, because a stale local ref would otherwise
  pass a stale script as current; --no-fetch states the assumption instead of
  hiding it.

Wiring (scripts/contract-run.sh): before executing, the wrapper runs the guard
against the clone it lives in. Default CONTRACT_REVISION_PREFLIGHT=enforce
withholds the verdict, alerts and exits 2 on mismatch; =warn logs and
continues; =off skips. Verified live: match -> contract proceeds and PASSes;
mismatch -> 'VERDICT WITHHELD', exit 2; =warn -> continues.

Pinning (docs/contract-execution-pinning.md): every contract pins the clone
contract-run.sh lives in - the deployed runner being /opt/contract-runner on
CT 100. Documented that daily-health-digest has no contract file at all, which
is why its execution copy was silently operator-chosen.

Tests: tests/test_revision_preflight.sh, 15 assertions over a throwaway clone
with a real bare remote. It runs the pre-fix draft against the same cases and
shows it passing a ghost script, so the tests provably bite.

shellcheck: scripts/revision-preflight.sh and the new test are clean. The three
findings remaining in contract-run.sh (SC2086 x2, SC2034) are pre-existing and
byte-identical on master.

scripts/contract-run.sh

@@ -18,6 +18,14 @@
 #   litellm-health            -> scripts/litellm-health-check.py
 #   disk-gc-threat-response   -> scripts/disk-gc-scan.py
 #   pm2-self-heal             -> scripts/pm2-self-heal.sh
+#   search-stack-visibility   -> scripts/search-stack-check.py
+#
+# Execution copy: every contract pins the clone this script lives in (see
+# docs/contract-execution-pinning.md). Before a contract runs, this wrapper
+# proves the script it is about to execute byte-matches origin/master:
+#   CONTRACT_REVISION_PREFLIGHT=enforce (default) refuse to report on mismatch
+#   CONTRACT_REVISION_PREFLIGHT=warn            log the mismatch and continue
+#   CONTRACT_REVISION_PREFLIGHT=off             skip the check entirely
 #
 # Exit codes:
 #   0 = contract passed
@@ -111,6 +119,35 @@ echo "Started: $(date -u '+%Y-%m-%d %H:%M:%S UTC')" | tee -a "$LOG_FILE"
 echo "Script: $SCRIPT_PATH" | tee -a "$LOG_FILE"
 echo "" | tee -a "$LOG_FILE"
 
+# ── Revision preflight ───────────────────────────────────────────────────────
+# A verdict is only meaningful if it came from the merged copy. Refuse to report
+# one from a mismatched or unverifiable copy; that is a probe failure (exit 2),
+# not a contract verdict, because the result would be untrustworthy.
+# See docs/contract-execution-pinning.md.
+REVISION_PREFLIGHT_MODE="${CONTRACT_REVISION_PREFLIGHT:-enforce}"
+REPO_ROOT="$(cd "${SCRIPTS_DIR}/.." && pwd)"
+if [ "$REVISION_PREFLIGHT_MODE" != "off" ] && [ -x "${SCRIPTS_DIR}/revision-preflight.sh" ]; then
+    if "${SCRIPTS_DIR}/revision-preflight.sh" "$SCRIPT_PATH" "$REPO_ROOT" 2>&1 | tee -a "$LOG_FILE"; then
+        :
+    elif [ "$REVISION_PREFLIGHT_MODE" = "warn" ]; then
+        echo "⚠️  revision preflight failed — continuing because CONTRACT_REVISION_PREFLIGHT=warn" | tee -a "$LOG_FILE"
+    else
+        echo "🚫 VERDICT WITHHELD: executing copy does not match the merged revision" | tee -a "$LOG_FILE"
+        ALERT_MSG="🔴 Contract $CONTRACT_NAME: revision mismatch — verdict withheld. Log: $LOG_FILE"
+        ZULIP_API_URL="${ZULIP_API_URL:-https://chat.sysloggh.net/api/v1}"
+        ZULIP_API_KEY="${ZULIP_API_KEY:-}"
+        ZULIP_USER="${ZULIP_USER:-abiba-bot@chat.sysloggh.net}"
+        if [ -n "$ZULIP_API_KEY" ] && command -v curl &> /dev/null; then
+            curl -sf -X POST "${ZULIP_API_URL}/messages" \
+                -u "${ZULIP_USER}:${ZULIP_API_KEY}" \
+                -d "type=private" \
+                -d "to=9" \
+                -d "content=${ALERT_MSG}" > /dev/null 2>&1 || true
+        fi
+        exit 2
+    fi
+fi
+
 # Use timeout to prevent hangs (10 minutes default)
 TIMEOUT=600
 timeout "$TIMEOUT" $INTERPRETER "$SCRIPT_PATH" 2>&1 | tee -a "$LOG_FILE"