FE-1112: Reconcile run-local executor promotion

[kostandinang]

What

Adds run-local executor promotion.

execute_promotion_prepare now commits verified changes inside the executor run worktree and records the sandbox commit SHA in promotion.json and run.json.

This does not apply changes back to the host project branch. Host promotion is handled by FE-1118.

Verification

npm run verify

[kostandinang]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-1118: Reconcile host executor promotion #282 : 2 dependent PRs (#284 , #285 )
• FE-1112: Reconcile run-local executor promotion #279 👈 (View in Graphite)
• FE-1111: Reconcile executor agent runner #278
• FE-1109: Reconcile executor sandbox worktrees and test runner ports #275
• FE-1089: Reconcile executor with alpha branch #274
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
First irreversible git mutation in the executor seam; recovery and idempotency logic are non-trivial though heavily tested and confined to run worktrees, not host branches.

Overview
Run-local promotion replaces the descriptive-only preparePromotion path: Petri-exported runs with a worktree call an injected GitLandPort to stage/commit inside the run worktree only, then write promotion.json (including land.commitSha) and advance run.json to promotion_prepared with promotionBaseSha / promotionCommitSha. Failures and true no-ops leave the run at petri_exported; a clean worktree after an earlier promote is distinguished from “never promoted” via HEAD vs base SHA and recovery logic.

Wiring: createGitLandPort in app runs git status / add / commit / rev-parse in the worktree; Pi extensions default-inject it, and execute_promotion_prepare takes gitLand. execute_status clears pending land and notes run-local promotion is ported.

Recovery: Retries can finish metadata when a promoted commit already exists (matching report + HEAD, or no_changes with HEAD ahead of base) without trusting stale report SHAs. Scope cards document the git-before-metadata failure mode and follow-up work.

^{Reviewed by Cursor Bugbot for commit 8cb164a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[lunelson]

The run-local promotion boundary is scoped well: the git mutation stays inside the run worktree and host promotion remains out of scope.

One thing to consider before FE-1118: promotion.json records the commit SHA, but not changed files or diff stats. Since host promotion will need to explain what is being carried forward, it may be useful for this report to include a small audit summary. Not blocking this PR.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fc35e8d. Configure here.}

[kostandinang]

Merge activity

• Jul 3, 5:42 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 3, 5:42 PM UTC: Graphite couldn't add this pull request to the GitHub merge queue because a downstack PR FE-1089: Reconcile executor with alpha branch #274 failed to merge.