fix(emit): never emit a wave whose parallel jobs share one checkout

[khymerao]

Fixes defect 2 of #12.

The defect, from the invariants

execution-manifest.md:359 declares invariant 7 enforced: parallel jobs sharing one tree "would also see its siblings' writes, yielding a false BLOCK", so run: parallel implies isolation: worktree. The validator enforces it on the manifest field and partition-reviewer verifies it.

The emitter then sets agent_isolation: None for any claude job with depends_on when the project lacks worktree.baseRef: head (emit-workflow.py:2028-2032), and topo_waves never re-checks (:745-806). Two such jobs in one wave are exactly the parallel+direct shape invariant 7 forbids: each direct-mode gate measures the whole tree minus a per-job before-image taken at register (:3458), so each attributes the other's writes and both BLOCK - deterministically, whenever both write before either gates.

The manifest passes a check the run does not honour, and the failure is reported as a scope violation by a worker that stayed in its lane.

Verified on the reporting project's records, not asserted: two dependents, both mode: direct, worktree: "", identical diff_digest; task-1's violations are precisely task-2's six write_allowed lanes, task-2's are task-1's two files plus seven run-dir artifacts; snapshot mtimes 09:01:35/36 against receipts at 09:10 and 09:12, so the overlap is proven rather than inferred. dispatch.workflow.js carries agent_isolation: null for every job.

This is not a designed signal. The author's own words call it a hazard: emit-workflow.py:3761 "the gate cannot tell two writers apart"; TROUBLESHOOTING.md:180 "several dependent jobs in the same wave share one checkout and can collide"; CHANGELOG.md:946 "Never seen before because every earlier dependent job was manifest-direct". This repository has shipped worktree.baseRef: head since f9bb486, so its own dogfooding never reaches the branch.

The fix

After topo_waves, a wave carrying 2+ main-checkout claude jobs is split so each runs alone. A wave is already a barrier, so more barriers is strictly safer, and one writer at a time is what attribution can handle. Jobs that get real worktrees - and every external backend, which owns its own tree and is gated in worktree mode - keep their parallelism.

Why serialize rather than refuse. House style leans fail-closed, and refusal at partition-review time is the honest alternative. I chose availability: the run still completes, one job at a time, and the operator is told what was re-shaped and which setting restores full parallelism. Refusing would turn a working-if-slower run into no run at all for a condition the project can fix in one line. Say the word and I will flip it to a refusal.

Corrections since the first revision (from review)

• The predicate is now the exact negation of job_entry's agent_isolation expression, not a second copy of the positive condition - two expressions to keep in sync is the drift class the emitter itself warns about. It therefore also counts a manifest-direct claude job, which is equally a main-tree writer; invariant 7 makes two of those unreachable through a validated manifest, but build_plan does not validate and the predicate should not lean on that.
• The decision is no longer ephemeral. It was one stderr line, gone the moment emit finished, while dispatch.workflow.js is what gets committed - an auditor comparing the reviewed partition (N waves) with the run (N+k) had no explanation. It is now carried on the plan as isolation_notes, empty on every run that was not re-shaped.
• README corrected. It listed the setting under Requirements as something that "has to be" head, which this change makes untrue - the run completes without it. README and TROUBLESHOOTING now both say the setting buys parallelism, not correctness.

Regressions considered

Resume relaunches the committed script, so the split is frozen with it. state.json.waves is written by the emitter and read by no other script. The residual dispatcher takes waves from the emit report. Split waves are subsets, so still <= max_parallel. The serial-job rule runs before this. Epic uses the same build_plan. External backends are excluded by the predicate.

Known limit, stated: _worktree_base_is_head reads only the project's .claude/settings.json. Claude Code also honours settings.local.json and the user-level file; someone who set the key there gets serialized and told to set it. That is pre-existing conservatism, and the note text names the file it actually reads.

Tests

534/534 (was 526/526). Mutation-checked - disabling the split fails the wave assertion with [['a'], ['b', 'c']], which is the defect itself. Full scripts/*.py --selftest sweep, lint-frontmatter, rules-lint green locally.

Note on CI

The red Full test suite is tests/test-native-points.sh, which fails 2 PRECOMPACT rows on a clean main too - the hardcoded-date time bomb that #11 fixes. Not from this branch.