feat: add semantic fleet normalization contract (E-00113)

[andrei-hasna]

E-00113

Replacement implementation for Todos task d70917d3-9eaa-4c3a-9bc2-e1da4967966d (E-00113) under native parent plan 8eadc06b-7276-4854-a6bc-b879866abf6f, parent goal 32e0d30d-e05a-45ce-9034-dfc9afeefd1d, parent active node e7994834-cd3e-4416-80fc-9e82bb8b59e8, and Todos plan a08dc545-512f-43ee-a553-6231a2131c50.

Terminal predecessor evidence is read-only: E-00110 / task d64671fb-1844-49a6-addd-020ee2b09ea2, closed unmerged PR #37, final head 3c7c8c6cc33bd1654db712a34df5ee111e0941d2. This remains the E-00113 replacement lineage and is not repair cycle 3 of E-00110.

• Acceptance scope: skills-fleet-normalization-semantic-v2
• Risk tier: elevated
• Repair cycle count: 2 of cap 2 (terminal)
• Original implementation head: 5899fe82d55b63a2ebb39456961272d7a32f7a10
• Repair 1 head: 3fdcfcb55351abf39e1613d6534a87f923c7cc83
• Terminal repair goal: 9c1db5ca-e0d5-4c4c-8a85-1ba49738b150
• Terminal writer generation: b92f3408-70b0-44fb-b3f0-36e69c7ad71d
• Terminal attempt nonce: 1bd4af82-1cf4-45f4-ad35-77de73761d1b
• Terminal repair run ID: 5c3d1c1a-ba24-405c-b9bd-3e45bed7433a
• Exact head: de3a71b5f69fee5041aed9583b6fa3ef25d0a5d8

Exact cumulative changed files

• agent-skills/README.md
• agent-skills/fleet-skill-normalization/SKILL.md
• src/lib/fleet-skill-normalization-skill.test.ts

Terminal repair reconciliation

The validator now rejects duplicate YAML mapping keys before parse at every admitted block-mapping depth and rejects alternate flow, quoted/complex-key, anchor, alias, and tag syntax. Frontmatter is bound to the exact supported key order, values, and ASCII skill identity, so duplicate keys, unknown keys, and Unicode-confusable names fail closed.

Canonical clauses are bound to their exact operative section, list marker, indentation, order, and single occurrence. HTML comments and CommonMark backtick or tilde fenced examples remain non-operative, including nested shorter fences and fake headings, and cannot satisfy required behavior.

Every enumerated run-state and target-state edge now has an explicit versioned transition receipt. Apply and rollback operation receipts are followed by matching target-transition receipts whose previous and transition-evidence digests bind the operation receipt without a future-digest cycle. Failure and terminal evidence bind the last transition receipts.

Touch and allowlist semantics now govern mutations while separately permitting provenance-bound immutable source reads without granting source mutation authority.

The nine terminal fixtures cover equal duplicate top-level and nested YAML keys, moved, indented, and cross-section duplicated required clauses, Unicode-confusable and duplicate frontmatter names, unknown frontmatter keys, and unknown structured fields. Repair-1 bypass and positive near-miss coverage remains intact.

Validation

• Previous-validator controlled red: 12 pass / 7 fail, proving seven newly repaired false negatives.
• Controlled unsafe red proof: 20 pass and exactly 1 deliberate injected failure, 145 assertions.
• Focused semantic suite: 21/21 tests, 145 assertions.
• Related isolated agent/corpus suite: 96/96 tests, 3,781 assertions.
• Bubblewrap-isolated serial full suite: 748/748 tests, 9,876 assertions.
• Typecheck and build: passed.
• Corpus drift against HEAD and origin/main: passed, 248/248/248.
• Bun pack dry-run: passed, 1,357 files, 11.47 MB.
• Release guard: passed, 1,359 package-visible files.
• Fresh labeled adversarial self-review: passed after repairing a receipt hash-cycle ambiguity and fenced-heading extraction ambiguity; final P0=0, P1=0, P2=0.
• Non-printing staged, exact repair range, cumulative range, and pre-push gitleaks scans: passed with no leaks.
• Provider-native exact-head CI: run 30025344158, job 89268275822, terminal success for de3a71b5f69fee5041aed9583b6fa3ef25d0a5d8; checkout, Bun setup/install, typecheck, test, and build passed.

No live distribution, merge, publish, release, package or lockfile change, generated-output change, Instructions change, parent native goal or plan mutation, or task-to-PR lifecycle edit occurred. E-00113 remains in_progress; the coordinator owns terminal exact-head review and merge or NO-GO.

Rollback

Before landing, close PR #39 unmerged. After landing, revert terminal repair commit de3a71b5f69fee5041aed9583b6fa3ef25d0a5d8, then repair-1 commit 3fdcfcb55351abf39e1613d6534a87f923c7cc83, then original implementation commit 5899fe82d55b63a2ebb39456961272d7a32f7a10 if the complete E-00113 change must be removed. No live skill distribution is part of this PR, so source rollback has no live-fleet side effect.

[andrei-hasna]

Terminal NO-GO: the final repair-cycle 2/2 review gate failed at exact head de3a71b. No third repair is permitted; any future work requires a newly scoped task and PR, not continuation of this branch.