feat: adopt deterministic route resolver

[JTInventory]

Summary

Adopts the useful non-merge route resolver commits from upstream kunchenguid/firstmate PR kunchenguid#85 onto the controlled JTInventory/firstmate baseline after PR #5.

This replay keeps the route resolver, spawn route evidence, cleanup-boundary fix, and stale task-identity guards. The only conflict was in bin/fm-pr-check.sh; resolution keeps both current controlled behavior (pr_head= verification) and PR kunchenguid#85 behavior (stale task/branch refusal).

Source

• Upstream PR: feat: add deterministic route resolver kunchenguid/firstmate#85
• Controlled base: fork/main at 5b6830758f85f9108e56aefec6fceaefdffc5386
• Replayed source commits:
  • b8773b3ec71c7add4041f6bfcc0678e4df112076 - feat: add deterministic route resolver
  • c766d0a479f16b567f392a260f59043bb2fbf3af - feat: record spawn route evidence
  • f4250d0f4cc4922e6999a0a12952d31175cd4dbe - fix route cleanup boundary matching
  • 397cb80f400488f5454a12d8effbf41efdc1b740 - fix: refuse stale task identity

Validation

bash tests/fm-route.test.sh
bash tests/fm-spawn-route.test.sh
bash tests/fm-task-identity.test.sh
bash -n bin/fm-route.sh bin/fm-spawn.sh bin/fm-pr-check.sh bin/fm-review-diff.sh bin/fm-task-identity-lib.sh bin/fm-teardown.sh tests/fm-route.test.sh tests/fm-spawn-route.test.sh tests/fm-task-identity.test.sh