fix(dispatch): background report signs with --from; coord-send refuses a worktree-derived sender

In a linked worktree basename(git toplevel) is the worktree's name, so the
background child's report was signed `from: dispatch-bg-form` (measured by
the PM on 741ada8) - a mailbox no session holds.

- skills/dispatch: the starter reports by full path with
  `coord-send.sh --from <repo> --to <sender>`; board-selftest §19b gains the
  check (red on 741ada8) plus a known-negative control that runs the same
  predicate against the old "via coord-send" wording.
- coord-send.sh: a DERIVED sender inside a linked worktree exits 2, naming
  --from and the repo the worktree belongs to. Chose refusal over a warning
  because stderr is where a session least looks and the mail would already be
  delivered, and over a silent redirect for the reason the retired
  ktg-plugin-marketplace address is rejected rather than redirected.
  Linked-ness is git's own test (git-dir != git-common-dir), not ".git is a
  file", because a submodule has that too. coord-selftest section 39: 9
  checks, 3 red before the fix; controls for submodule, main checkout,
  explicit --from and a worktree named like its repo.
- Six other scripts derive identity the same way; named as a bounded gap in
  CLAUDE.md, not changed (not ordered).

Suites under /bin/bash 3.2: coord 266, board 497, route 73, orders 116,
guard 54 = 1006 (was 995). npm test 12/12.

Order 20260923T082933Z-466405184-from-.claude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/coord-selftest.sh

@@ -1388,6 +1388,46 @@ check "launchd control: a program path INSIDE the plugin cache is caught" $?
 
 /bin/rm -f "$BADPL" "$CACHEPL" 2>/dev/null
 
+# 39. A LINKED WORKTREE's directory name is not a repo name, so a sender derived
+# from it is invented, and section 22's rule applies: refuse, never guess.
+# Order 20260923T082933Z-466405184 (.claude): a background child runs in
+# <repo>/.claude/worktrees/<name>, and basename(git toplevel) there is <name>.
+# Measured by the PM on 741ada8: the child's report arrived signed
+# `from: dispatch-bg-form`, a mailbox no session holds, so any reply to it
+# would have gone nowhere. Linked-ness is git's own test (git-dir differs from
+# git-common-dir), not a path pattern and not ".git is a file": a SUBMODULE also
+# has .git as a file, and its basename IS its real name - the control below.
+WT="$(cd "$(mktemp -d)" && pwd -P)"
+git -C "$WT" init -q wtmain >/dev/null 2>&1
+git -C "$WT/wtmain" -c user.name=t -c user.email=t@t -c commit.gpgSign=false commit -q --allow-empty -m init >/dev/null 2>&1
+git -C "$WT/wtmain" worktree add -q "$WT/wt-child" >/dev/null 2>&1
+[ -f "$WT/wt-child/.git" ]; check "worktree fixture: wt-child really is a linked worktree (ground truth)" $?
+wto="$( (cd "$WT/wt-child" && "$SEND" --to wttarget --subject s --message "WT-BODY" </dev/null) 2>&1 )"; rc=$?
+[ "$rc" -eq 2 ]; check "worktree: a sender derived in a linked worktree is refused (exit 2)" $?
+[ -z "$(ls "$CLAUDE_COORD_DIR/wttarget/inbox" 2>/dev/null)" ]; check "worktree: nothing is delivered under the worktree's name" $?
+printf '%s' "$wto" | grep -q -- '--from wtmain'; check "worktree: the refusal names --from and the repo the worktree belongs to" $?
+wtok="$( (cd "$WT/wt-child" && "$SEND" --to wttarget --from wtmain --subject s --message "WT-OK" </dev/null) 2>&1 )"; rc=$?
+[ "$rc" -eq 0 ] && grep -q '^from: wtmain$' "$CLAUDE_COORD_DIR"/wttarget/inbox/*.md 2>/dev/null
+check "worktree control: an explicit --from still sends from inside the worktree" $?
+wtm="$( (cd "$WT/wtmain" && "$SEND" --to wtmaintarget --subject s --message "WT-MAIN" </dev/null) 2>&1 )"; rc=$?
+[ "$rc" -eq 0 ] && grep -q '^from: wtmain$' "$CLAUDE_COORD_DIR"/wtmaintarget/inbox/*.md 2>/dev/null
+check "worktree control: the MAIN checkout of the same repo still derives its sender" $?
+# A worktree whose directory happens to carry the repo's own name derives the
+# right identity, so refusing it would be a false positive.
+mkdir -p "$WT/elsewhere"
+git -C "$WT/wtmain" worktree add -q "$WT/elsewhere/wtmain" >/dev/null 2>&1
+( cd "$WT/elsewhere/wtmain" && "$SEND" --to wtsame --subject s --message "WT-SAME" </dev/null >/dev/null 2>&1 ); rc=$?
+[ "$rc" -eq 0 ]; check "worktree control: a worktree named exactly like its repo is not refused" $?
+# Submodule control: .git is a file there too, and git-dir == git-common-dir.
+git -C "$WT" init -q wtsub >/dev/null 2>&1
+git -C "$WT/wtsub" -c user.name=t -c user.email=t@t -c commit.gpgSign=false commit -q --allow-empty -m init >/dev/null 2>&1
+git -C "$WT/wtmain" -c protocol.file.allow=always submodule add -q "$WT/wtsub" wtsub >/dev/null 2>&1
+[ -f "$WT/wtmain/wtsub/.git" ]; check "submodule fixture: .git really is a file in the submodule (ground truth)" $?
+( cd "$WT/wtmain/wtsub" && "$SEND" --to wtsubtarget --subject s --message "WT-SUB" </dev/null >/dev/null 2>&1 ); rc=$?
+[ "$rc" -eq 0 ] && grep -q '^from: wtsub$' "$CLAUDE_COORD_DIR"/wtsubtarget/inbox/*.md 2>/dev/null
+check "worktree control: a SUBMODULE (.git is a file) still derives its own name" $?
+/bin/rm -rf "$WT" 2>/dev/null
+
 echo "----"
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]