feat: worktree_ref pinning + SIGHUP graceful shutdown

[usjoh]

Two hardening changes from the 2026-07-31 Observer-Triad closeout arc, plus the MODEL-NOTES scoreboard correction for the rows that arc misclassified.

worktree_ref — pin the commit task worktrees are created at

Run-level manifest field, default HEAD (zero behavior change when absent). Worktree creation is orchestrator-side and unsandboxed, so pinning an older immutable baseline is free. Without it, yesterday's dispatch needed a spec-side git checkout inside the Ringer worktree — which fails outright under workspace-write (.git/worktrees/<id>/index.lock is outside the writable roots, cost: two failed dispatches to diagnose) — and the working fallback made each worker git clone the repo into its own taskdir, burning tokens on plumbing.

• Both worktree add sites (run + baseline) take the ref, --detach on both so a branch-name ref can't fail on "already checked out"
• worktree_ref without worktrees: true is a manifest error
• from_path/with_max_parallel rebuilt on dataclass_replace so future Manifest fields can't be silently dropped by field-copying constructors

SIGHUP joins the graceful-shutdown set

A run's parent is often an interactive agent session. When one died mid-run yesterday (network drop), the shell HUP'd the group: the orchestrator died before any flush — ghost state (live/unfinished forever), workers killed, no ERROR verdicts. SIGHUP now triggers the same graceful path as SIGINT/SIGTERM.

nohup semantics preserved: an inherited SIG_IGN is respected — installing a handler over it would turn nohup's hangup-survival promise into a graceful shutdown. Tested both ways.

Testing

325 → 332, full suite green. Mutation-tested at every wired site — four mutations, four caught:

mutation	caught by
run-path worktree add reverted to HEAD	e2e: pinned-ref run asserts the checked-out sha
baseline-path worktree add reverted to HEAD	baseline check passes only in the pinned commit's tree
SIGHUP never registered	HUP → rc 130 + finished state
SIG_IGN check dropped	nohup-semantics test: run must survive HUP

MODEL-NOTES

Dated correction under gpt-5.6-sol for the three 2026-07-31 failure_class=model FAIL rows that were sandbox-contract and killed-run casualties, with the re-run evidence (same three lanes: 3/3 first-try, READY×3).