test(pm-agent): a committed negative-path probe for the worker's input guards

pm-worker's command is pinned by admission with no args, so everything a caller could
influence arrives in the environment — and the guards at the top of that script are what
stand between an injected variable and a clone from the wrong host or a push to the
wrong ref. Nothing exercised them, which makes them a claim rather than a control.

probe-validation.sh asserts 17 refusals, each on BOTH a non-zero exit and the specific
message, so a guard that stopped firing cannot pass by failing somewhere else. It covers
a redirected git host, a real and reachable WRONG one (the egress policy permits tcp/443,
so that case is not hypothetical), the right host with a smuggled path, 'main' and five
other bad branch shapes, a malformed owner/repo, a bad mode, a bad issue number, and each
missing credential. build-image.sh runs it inside the built image too.

Writing it found three things:
 - the PM_BRANCH != main guard is unreachable while the pattern check above it holds, so
   the comment claiming it as the defence was wrong about which line does the work. Kept
   as an assertion independent of the regex; the comment now says so.
 - the EXIT trap ended in a failing test, which under set -e can replace the script's
   real exit code with that failure.
 - a provenance LOG LINE read a file through a redirect that set -o pipefail would have
   turned into a dead worker if the file were absent.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

decisions/2026-10-05-pm-agent-issue-to-pr.md

@@ -90,6 +90,26 @@ All offline, in the pinned toolbox (`./infra/devcontainer/dev.sh run`), never on
      kustomization, because the kustomization's comment named it by filename. Correctly
      refused: the distance between a filename in a comment and a line under `resources:` is
      one careless edit. The comment now points at it in prose.
+- **`infra/agent/probe-validation.sh` → 17 refusals, 0 failures.** A new, committed
+  negative-path probe for `pm-worker`'s input guards — the things that stand between an
+  injected environment variable and a clone from the wrong host or a push to the wrong ref.
+  Each case asserts a non-zero exit AND the specific message, so a guard that stopped firing
+  cannot pass by failing somewhere else. It refuses: an argument on the pinned command;
+  `main`, a wrong prefix, `feat/x;id`, `../../etc/passwd`, too-short slugs, and a branch equal
+  to the base; a redirected git host, a real-and-reachable wrong one (`github.com` — the
+  egress policy permits tcp/443, so this one is genuinely reachable), and the right host with
+  a smuggled path; a malformed owner or repository; an unknown mode; a non-numeric and a zero
+  issue number; and each missing credential. `build-image.sh` also runs it inside the built
+  image, where the interpreter is the one that will run in the cluster.
+- **Writing that probe corrected an overclaim in the code.** The `PM_BRANCH != "main"` guard
+  is UNREACHABLE while the pattern check above it holds (`main` has no `feat|fix|docs|chore/`
+  prefix), so the comment claiming it as the defence against pushing to main was wrong about
+  which line does the work. It is kept — as an assertion that does not depend on the regex
+  being right — and the comment now says so.
+- **Two more defects found by self-review of the unattended paths, both fixed:** the worker's
+  `EXIT` trap ended in a failing test, which under `set -e` can replace the script's real exit
+  code with that failure; and a provenance *log line* read a file through a redirect that
+  `set -o pipefail` would have turned into a dead worker if the file were absent.
 - **A self-review of the trigger found and fixed one real defect** before any of this ran:
   `last_activity()` compared RFC 3339 timestamp STRINGS to find the newest comment, which is
   only correct while every offset Gitea returns is identical — and the failure mode is the