test(pm-agent): a committed negative-path probe for the worker's input guards

pm-worker's command is pinned by admission with no args, so everything a caller could
influence arrives in the environment — and the guards at the top of that script are what
stand between an injected variable and a clone from the wrong host or a push to the
wrong ref. Nothing exercised them, which makes them a claim rather than a control.

probe-validation.sh asserts 17 refusals, each on BOTH a non-zero exit and the specific
message, so a guard that stopped firing cannot pass by failing somewhere else. It covers
a redirected git host, a real and reachable WRONG one (the egress policy permits tcp/443,
so that case is not hypothetical), the right host with a smuggled path, 'main' and five
other bad branch shapes, a malformed owner/repo, a bad mode, a bad issue number, and each
missing credential. build-image.sh runs it inside the built image too.

Writing it found three things:
 - the PM_BRANCH != main guard is unreachable while the pattern check above it holds, so
   the comment claiming it as the defence was wrong about which line does the work. Kept
   as an assertion independent of the regex; the comment now says so.
 - the EXIT trap ended in a failing test, which under set -e can replace the script's
   real exit code with that failure.
 - a provenance LOG LINE read a file through a redirect that set -o pipefail would have
   turned into a dead worker if the file were absent.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

infra/agent/build-image.sh

@@ -134,6 +134,21 @@ if [ "${VERIFY}" -eq 1 ]; then
       echo "--- no Anthropic API key is baked into the image (it would outrank the subscription token) ---"
       [ -z "${ANTHROPIC_API_KEY:-}${ANTHROPIC_AUTH_TOKEN:-}" ] && echo "    confirmed: neither is set"
     '
+  # The worker's input guards, exercised in the image, with the interpreter and the script
+  # that will actually run in the cluster. The probe is mounted read-only rather than baked
+  # in: it is a build-time check, not something a worker Job has any business carrying.
+  log "Probing pm-worker's input validation inside the image"
+  "${ENGINE}" run --rm \
+    --user 65532:65532 \
+    --read-only \
+    --tmpfs /workspace:rw,mode=1777 \
+    --tmpfs /tmp:rw,mode=1777 \
+    --network none \
+    --volume "${HERE}/probe-validation.sh:/probe-validation.sh:ro,Z" \
+    --entrypoint "" \
+    "${IMAGE_REF}" \
+    /bin/bash /probe-validation.sh
+
   log "Image verified"
 fi