feat: add live secondmate config push

[kunchenguid]

Intent

Improve firstmate inheritable-config propagation so mid-session changes to local inherited config, especially config/crew-dispatch.json, reach already-live secondmate homes reliably and visibly. Keep propagate_inheritable_config as the single propagation truth with stdout still silent for existing callers, but emit concise stderr diagnostics for guard skips and copy/remove errors. Add a focused config-only push command that reuses shared live secondmate discovery from state/*.meta plus data/secondmates.md fallback and the same propagation helper, reports per-home/per-item pushed/unchanged/skipped/error results, does not fast-forward tracked files, and does not nudge secondmates. Update AGENTS/docs/secondmate-provisioning guidance and tests for visible skips, clean silent propagation, command reporting, no-fast-forward/no-nudge behavior, warning vs hard-error exit codes, and dirty/invalid home visibility.

What Changed

• Added bin/fm-config-push.sh to push inheritable config into live secondmate homes without fast-forwarding tracked files or nudging secondmates.
• Centralized live secondmate discovery and enhanced propagate_inheritable_config with silent success behavior plus visible stderr diagnostics for guard skips and copy/remove errors.
• Updated firstmate guidance, script/config docs, and secondmate harness tests to cover config-only push reporting, dirty or invalid homes, skip visibility, and no-nudge behavior.

Captain, pipeline validation passed for intent, rebase, review, tests, docs, lint, and push.

Risk Assessment

✅ Low: Captain, the change is well-scoped to config propagation/discovery, keeps the existing guarded inheritance model intact, and I did not find material correctness or safety regressions.

Testing

The configured full test command was already reported successful as baseline; I reran the focused secondmate harness/config and sync suites, captured their outputs, and manually exercised the live config-push flow with persisted CLI evidence. All checks passed, and the worktree stayed clean.

Evidence: manual config-push transcript

# Manual smoke: fm-config-push live secondmate config propagation
worktree under evidence: /var/folders/5x/4nqprlbx0518k3ybcb1sz6gr0000gn/T/no-mistakes-evidence/01KWCTDVJXV9958P12A1Q5CQE0/manual-config-push-world

$ git init primary firstmate repo and live detached secondmate home
secondmate HEAD before primary advances: 3d5d59d

$ advance primary tracked files to prove config-push does not fast-forward the secondmate
primary HEAD after tracked-file change: 1460368

$ write primary inherited config and run bin/fm-config-push.sh
exit status: 0
--- stdout ---
config-push: <world>/home/config -> live secondmate homes
secondmate sm-live (<world>/sm-live):
  crew-dispatch.json: pushed
  crew-harness: pushed
  backlog-backend: pushed
--- stderr ---

$ verify downstream config and tracked HEAD
secondmate HEAD after config-push: 3d5d59d
tracked HEAD unchanged: yes
crew-dispatch.json: {"default":{"harness":"codex","model":"gpt-5","effort":"low"}}
crew-harness: codex
backlog-backend: manual
nudge emitted: no

$ run the same command again to prove idempotent unchanged reporting
--- stdout ---
config-push: <world>/home/config -> live secondmate homes
secondmate sm-live (<world>/sm-live):
  crew-dispatch.json: unchanged
  crew-harness: unchanged
  backlog-backend: unchanged
--- stderr ---

Evidence: fm-secondmate-harness test output

ok - A1 fm-harness.sh secondmate resolves the fallback chain; crew mode unchanged
ok - B1 propagate_inheritable_config: copy, idempotence, convergence, absence-mirror, exclusion, no-op, skip diagnostics
ok - B2 spawn: secondmate runs the secondmate harness; its home inherits declared config
ok - B3 spawn: an absent secondmate-harness falls back to the crew harness (backward-compat)
ok - B4 spawn: no config at all -> own harness and no propagation side effects
ok - B5 spawn: an explicit per-spawn harness arg overrides config/secondmate-harness
ok - B6 spawn: an unverified resolved secondmate harness is refused (guard intact)
ok - B7 bootstrap sweep pushes, re-converges, and mirrors absence; never inherits secondmate-harness
ok - B8 bootstrap sweep propagates config even when the home's tracked files are already current
ok - B9 bootstrap sweep defers new inherited config until the home ignores it
ok - B10 bootstrap sweep with no inheritable config is a config no-op and still fast-forwards
ok - B11 bootstrap sweep surfaces config propagation failures
ok - B12 config-push propagates via shared live discovery, reports items, and does not fast-forward or nudge
ok - B13 config-push reports dirty, non-allowing, and invalid homes without failing warnings-only runs
ok - B14 config-push exits nonzero on real propagation errors
# all fm-secondmate-harness tests passed

Evidence: fm-secondmate-sync test output

ok - T1 updated: a behind home fast-forwards to the primary's local HEAD
ok - T2 current: an already-current home is a no-op and reports no instruction change
ok - T3 dirty: an uncommitted home is skipped, its edit preserved
ok - T4 diverged: a home that is not an ancestor of the primary's HEAD is skipped
ok - T5 in-flight: a home on a feature branch is skipped, its work preserved
ok - T6 no fetch: the local-HEAD sync never invokes git fetch
ok - T7 sweep nudges on a real instruction change only, but still fast-forwards
ok - T8 bootstrap sweeps live homes, nudges only the running real-instruction-change secondmate
ok - T9 bootstrap surfaces a skipped dirty live secondmate home
ok - T10 spawn fast-forwards a secondmate worktree to the primary's local HEAD before launch
ok - T11 spawn warns when pre-launch sync is skipped
# all fm-secondmate-sync tests passed

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• bash tests/fm-secondmate-harness.test.sh
• bash tests/fm-secondmate-sync.test.sh
• bash tests/fm-secondmate-harness.test.sh > /var/folders/5x/4nqprlbx0518k3ybcb1sz6gr0000gn/T/no-mistakes-evidence/01KWCTDVJXV9958P12A1Q5CQE0/fm-secondmate-harness.test.out 2>&1
• bash tests/fm-secondmate-sync.test.sh > /var/folders/5x/4nqprlbx0518k3ybcb1sz6gr0000gn/T/no-mistakes-evidence/01KWCTDVJXV9958P12A1Q5CQE0/fm-secondmate-sync.test.out 2>&1
• Manual end-to-end smoke check captured in /var/folders/5x/4nqprlbx0518k3ybcb1sz6gr0000gn/T/no-mistakes-evidence/01KWCTDVJXV9958P12A1Q5CQE0/manual-config-push-transcript.txt

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.