fix(dispatch): background report signs with --from; coord-send refuses a worktree-derived sender

In a linked worktree basename(git toplevel) is the worktree's name, so the
background child's report was signed `from: dispatch-bg-form` (measured by
the PM on 741ada8) - a mailbox no session holds.

- skills/dispatch: the starter reports by full path with
  `coord-send.sh --from <repo> --to <sender>`; board-selftest §19b gains the
  check (red on 741ada8) plus a known-negative control that runs the same
  predicate against the old "via coord-send" wording.
- coord-send.sh: a DERIVED sender inside a linked worktree exits 2, naming
  --from and the repo the worktree belongs to. Chose refusal over a warning
  because stderr is where a session least looks and the mail would already be
  delivered, and over a silent redirect for the reason the retired
  ktg-plugin-marketplace address is rejected rather than redirected.
  Linked-ness is git's own test (git-dir != git-common-dir), not ".git is a
  file", because a submodule has that too. coord-selftest section 39: 9
  checks, 3 red before the fix; controls for submodule, main checkout,
  explicit --from and a worktree named like its repo.
- Six other scripts derive identity the same way; named as a bounded gap in
  CLAUDE.md, not changed (not ordered).

Suites under /bin/bash 3.2: coord 266, board 497, route 73, orders 116,
guard 54 = 1006 (was 995). npm test 12/12.

Order 20260923T082933Z-466405184-from-.claude.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/coord-send.sh

@@ -22,6 +22,8 @@
 #   the broadcast queue so no future repo receives it. This is un-send, not
 #   recall - repos that already received it are unaffected.
 # --from overrides the sender/self identity (default: basename of git toplevel/cwd).
+# Inside a linked git worktree the default is refused (exit 2): the toplevel's
+# basename there is the worktree's name, not the repo's - pass --from.
 #
 # Exit: 0 delivered, 1 delivered but --reply-to's original could NOT be closed
 #   (the reply is sent; do not re-send it, close the original by hand),
@@ -62,13 +64,33 @@ done
 # a real message was delivered under exactly that name. An invented identity is
 # worse than none: it signs mail as a repo that does not exist and, on the read
 # side, opens a mailbox that may belong to someone else. Refuse and say how.
+DERIVED_FROM=0
 if [ -z "$FROM" ]; then
   FROM="$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null)"
+  DERIVED_FROM=1
 fi
 if [ -z "$FROM" ]; then
   echo "coord-send: cannot resolve sender identity (not inside a git repo); pass --from <repo> to choose one explicitly" >&2
   exit 2
 fi
+# The same rule for a LINKED WORKTREE: its toplevel basename is the worktree's
+# directory name (<repo>/.claude/worktrees/<name> for a background session), so
+# the derived sender is invented. git's own test decides linked-ness - git-dir
+# differs from git-common-dir - because ".git is a file" is also true of a
+# submodule, whose basename IS its name. A worktree directory that happens to
+# carry the repo's own name derives correctly and passes. Fails OPEN when git
+# cannot answer: the refusal needs a positive measurement.
+if [ "$DERIVED_FROM" -eq 1 ]; then
+  WT_GD="$(git rev-parse --path-format=absolute --git-dir 2>/dev/null)"
+  WT_CD="$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)"
+  if [ -n "$WT_GD" ] && [ -n "$WT_CD" ] && [ "$WT_GD" != "$WT_CD" ]; then
+    WT_REPO="$(basename "$(dirname "$WT_CD")")"
+    if [ "$FROM" != "$WT_REPO" ]; then
+      echo "coord-send: refusing to sign as '$FROM': that is a linked git worktree's directory name, not a repo name; pass --from explicitly (this worktree belongs to: --from $WT_REPO)" >&2
+      exit 2
+    fi
+  fi
+fi
 # A leading _ is reserved for engine internals (_broadcast today; the rule
 # reserves the namespace so a later _seen or _config cannot reopen the hole).
 case "$FROM" in