fix(graceful-handoff): two defects found by the first real smoke test (v3.2.1)

The pipeline had never been run against an actual repository — every test in
the suite is either a prose-grep over SKILL.md or a unit test that asserts key
presence. Running it against scratch repos (private remote, and public `open/`
remote with and without a gitignored STATE.md) found two defects living under
a 42/42-green suite.

1. dirty_files truncated the first path. gitOk() trims every command's output,
   but `git status --porcelain` puts the worktree status in column 2, so a
   modified-but-unstaged file is " M path". The trim ate the leading space and
   the fixed slice(3) then ate the first character: app.js was reported as
   pp.js. Only the first line is affected, which is why it survived — no test
   asserted dirty_files VALUES, only that the key existed. Porcelain now goes
   through a non-trimming gitOkRaw().

2. The commit message claimed a STATE.md update it did not contain. The
   message was hardcoded to "oppdater STATE.md" regardless of what was staged.
   On every `open/` repo STATE.md is gitignored, so the handoff commit carries
   only the --also paths. Git history is the regime's long-term log; it was
   systematically wrong about its own contents.

Also promotes the leak condition from advisory to hard gate. A public remote
whose STATE.md is not yet gitignored is the state a FRESH open/ repo starts
in, and should_commit_state was true there — the ritual only mentioned
leak_warning, then committed. It now lands in errors[] (step 2 stops on a
non-empty errors[]), should_commit_state is false, and --commit refuses to
stage STATE.md. Explicit --also paths are still honoured: the gate protects
STATE.md, not the commit as a whole.

And corrects SKILL.md's justification for the single-line rule. It claimed a
wrapped rationale= replaces the board's next step with garbage; board.sh in
repo-mailbox 0.20.3 tracks a comment to its closer, so that no longer follows.
The rule stands, restated with the risk that is still real: a rationale
containing the closer sequence ends its own comment early.

Tests 42 -> 48, all six written failing first.

Still unverified: that /graceful-handoff loads as a user command (#26251), and
that a cross-plugin Skill invocation of repo-mailbox:route passes from a
sub-scoped skill. Both need the catalog ref bumped so the version is installed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RvLY4FwbzY157oVqwnkHD8

tests/scripts/handoff-pipeline.test.mjs

@@ -118,6 +118,54 @@ test('--plan: private remote → should_commit_state true, not local-only', asyn
   rmSync(repo, { recursive: true, force: true });
 });
 
+test('--plan: dirty_files keeps the first character of a worktree-only change', async () => {
+  // Regression (smoke-test 2026-08-09): `git status --porcelain` encodes the
+  // worktree status in column 2, so a modified-but-unstaged file is " M path".
+  // gitOk() trimmed the whole command output, eating that leading space, and
+  // the fixed slice(3) then ate the first character of the FIRST path:
+  // "app.js" was reported as "pp.js". Only the first line is affected, which is
+  // why it survived every existing test — none asserted dirty_files values.
+  const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/ktg/secret.git' });
+  writeFileSync(join(repo, 'README.md'), '# test modified\n', 'utf-8'); // tracked → " M README.md"
+  writeFileSync(join(repo, 'zz-untracked.txt'), 'x\n', 'utf-8');        // sorts after → "?? zz-..."
+  const result = await runPipeline(repo, ['--plan']);
+  const json = JSON.parse(result.stdout);
+  assert.ok(
+    json.dirty_files.includes('README.md'),
+    `first dirty path truncated: ${JSON.stringify(json.dirty_files)}`
+  );
+  assert.ok(json.dirty_files.includes('zz-untracked.txt'), 'untracked path missing');
+  rmSync(repo, { recursive: true, force: true });
+});
+
+// ---------- leak hard-gate (public remote + STATE.md not gitignored) ----------
+
+test('--plan: public remote + STATE not gitignored BLOCKS the ritual (errors, no commit)', async () => {
+  const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/open/foo.git' });
+  const result = await runPipeline(repo, ['--plan']);
+  const json = JSON.parse(result.stdout);
+  assert.equal(json.should_commit_state, false, 'must not advertise STATE.md as committable');
+  assert.ok(
+    json.errors.some(e => /gitignore/i.test(e)),
+    `expected a blocking leak error naming the remedy, got ${JSON.stringify(json.errors)}`
+  );
+  rmSync(repo, { recursive: true, force: true });
+});
+
+test('--commit refuses to stage STATE.md on a public remote when it is not gitignored', async () => {
+  const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/open/foo.git' });
+  writeFileSync(join(repo, 'STATE.md'), '# STATE would leak\n');
+  const result = await runPipeline(repo, ['--commit']);
+  const json = JSON.parse(result.stdout);
+  const tracked = execFileSync('git', ['ls-files', 'STATE.md'], { cwd: repo, encoding: 'utf-8' }).trim();
+  assert.equal(tracked, '', 'STATE.md must never become tracked on a public remote');
+  assert.ok(
+    json.errors.some(e => /gitignore/i.test(e)),
+    `expected a blocking leak error, got ${JSON.stringify(json.errors)}`
+  );
+  rmSync(repo, { recursive: true, force: true });
+});
+
 // ---------- --commit ----------
 
 test('--commit on private repo stages and commits ONLY STATE.md', async () => {
@@ -175,6 +223,26 @@ test('--commit on public repo does NOT commit gitignored STATE.md', async () =>
   rmSync(repo, { recursive: true, force: true });
 });
 
+test('--commit message does not claim a STATE.md update when STATE.md was skipped', async () => {
+  // On every `open/` repo STATE.md is gitignored, so the handoff commit carries
+  // only the explicit --also paths. The message claimed "oppdater STATE.md"
+  // regardless, making git history — the regime's long-term log — systematically
+  // wrong about what the commit contains.
+  const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/open/foo.git', gitignoreState: true });
+  writeFileSync(join(repo, 'STATE.md'), '# STATE local-only\n');
+  writeFileSync(join(repo, 'code.mjs'), 'export const x = 1;\n');
+  const result = await runPipeline(repo, ['--commit', '--also', 'code.mjs']);
+  const json = JSON.parse(result.stdout);
+  assert.ok(json.actions_taken.includes('committed'), `expected a commit, got ${JSON.stringify(json.actions_taken)}`);
+  assert.doesNotMatch(
+    json.commit_message,
+    /oppdater STATE\.md/,
+    `commit claims a STATE.md update it does not contain: ${json.commit_message}`
+  );
+  assert.match(json.commit_message, /local-only/, 'message should say why STATE.md is absent');
+  rmSync(repo, { recursive: true, force: true });
+});
+
 test('--commit on detached HEAD is detected (no commit attempted)', async () => {
   const repo = makeTempRepo({ remote: 'ssh://git@git.fromaitochitta.com/ktg/secret.git' });
   const sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: repo, encoding: 'utf-8' }).trim();