test(pm-agent): a committed negative-path probe for the worker's input guards

pm-worker's command is pinned by admission with no args, so everything a caller could
influence arrives in the environment — and the guards at the top of that script are what
stand between an injected variable and a clone from the wrong host or a push to the
wrong ref. Nothing exercised them, which makes them a claim rather than a control.

probe-validation.sh asserts 17 refusals, each on BOTH a non-zero exit and the specific
message, so a guard that stopped firing cannot pass by failing somewhere else. It covers
a redirected git host, a real and reachable WRONG one (the egress policy permits tcp/443,
so that case is not hypothetical), the right host with a smuggled path, 'main' and five
other bad branch shapes, a malformed owner/repo, a bad mode, a bad issue number, and each
missing credential. build-image.sh runs it inside the built image too.

Writing it found three things:
 - the PM_BRANCH != main guard is unreachable while the pattern check above it holds, so
   the comment claiming it as the defence was wrong about which line does the work. Kept
   as an assertion independent of the regex; the comment now says so.
 - the EXIT trap ended in a failing test, which under set -e can replace the script's
   real exit code with that failure.
 - a provenance LOG LINE read a file through a redirect that set -o pipefail would have
   turned into a dead worker if the file were absent.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/plans/pm-agent-issue-to-pr.md

@@ -215,7 +215,10 @@ holds a git write token and can author code. So:
 under the pinned CLI (the first run was 27/28 and caught a real defect: the volume rule
 denied a valid `emptyDir: {}`); `check-jsonschema` on the changed ServiceDefinition; the
 canonical render reproduces `apps/wave-0/gitea.yaml` with the new policy in it; `bash -n`
-and `ast.parse` on the two entrypoints. **`./ci/gate.sh` → exit 3 (UNDETERMINED), with
+and `ast.parse` on the two entrypoints; `PM_SELFTEST=1 pm-dispatch` → 26 assertions, 0
+failures; `infra/agent/probe-validation.sh` → **17 refusals, 0 failures** against
+`pm-worker`'s input guards, including the three that matter most (a redirected git host, a
+reachable-but-wrong one, and `main` as the branch). **`./ci/gate.sh` → exit 3 (UNDETERMINED), with
 `gitea-settings` the one stage that did not run** — no `SETTINGS_API_TOKEN` on this
 workstation — and every other stage green, `spec-immutability` included. rc 3 is not a pass.
 The gate also refused an earlier revision of this change twice, both times correctly; see