fix(e2e): thread reconstruct identity param + m1 rejection rationale — F3/F4 stragglers

The two e2e call sites of BuildGitReconstructCommand gained the F3
identity parameter (robot constant — test fixtures); the m1 backlog
rejection note explains why both of its halves are resolved (set-if-absent
supersedes the always-re-set sketch it proposed; the self-heal net at
every consumption point makes the bootstrap hard-fail redundant).

Author: krls2020

e2e/git_delivery_fullchain_test.go

@@ -116,7 +116,7 @@ func TestE2E_GitDeliveryFullChain(t *testing.T) {
 	t.Log("container replaced git-less (legacy no -g workflow) — exercising live reconstruction")
 
 	// 4. Live reconstruction from the recorded remote.
-	if out, err := ssh.ExecSSH(ctx, hostname, ops.BuildGitReconstructCommand("/var/www", remote)); err != nil {
+	if out, err := ssh.ExecSSH(ctx, hostname, ops.BuildGitReconstructCommand("/var/www", remote, ops.DeployGitIdentity)); err != nil {
 		t.Fatalf("reconstruction: %v\n%s", err, out)
 	}
 	state, err := ssh.ExecSSH(ctx, hostname,

e2e/git_delivery_live_test.go

@@ -90,7 +90,7 @@ func TestE2E_GitDeliveryPrimitives(t *testing.T) {
 	// no longer exists.
 
 	t.Run("reconstruction no-ops on present repo", func(t *testing.T) {
-		if _, err := ssh.ExecSSH(ctx, hostname, ops.BuildGitReconstructCommand("/var/www", remote)); err != nil {
+		if _, err := ssh.ExecSSH(ctx, hostname, ops.BuildGitReconstructCommand("/var/www", remote, ops.DeployGitIdentity)); err != nil {
 			t.Fatalf("reconstruction guard run failed: %v", err)
 		}
 		headAfter, err := ssh.ExecSSH(ctx, hostname, "cd /var/www && git rev-parse HEAD 2>/dev/null || echo NONE")

plans/backlog/rejected/m1-glc-safety-net-identity-reset.md

@@ -1,5 +1,15 @@
 # Tighten the GLC `.git/` identity safety net (M1)
 
+**Why rejected (2026-07-12)**: both halves resolved by the git-contract fix
+(`plans/git-contract-2026-07-12.md`). Half 1 ("always re-set identity") is
+now an ANTI-PATTERN — the unconditional overwrite it prescribed (shipped
+f7a22c01→6720c923) caused the exact user-identity stomping this entry's own
+Risks section predicted; P1 replaced it with set-if-absent
+(`ops/git_identity.go`). Half 2 (bootstrap hard-fail on InitServiceGit
+error) is redundant: the repo/identity/HEAD invariant now self-heals at
+every consumption point (deploy safety-net, git-push-setup pre-probe), so a
+swallowed bootstrap failure has no surviving failure mode to hard-fail on.
+
 **Surfaced**: 2026-04-29 — `docs/audit-prerelease-internal-testing-2026-04-29.md`
 finding M1. `InitServiceGit` failure is logged stderr-only at
 `internal/tools/workflow_bootstrap.go:204-206` (no error propagation). Deploy-