Write the commit and verify what landed from agentrepo commit #854

Problem

The second half of commit.sh runs git commit, then explains a failure (staged paths dropped, a hook that changed nothing versus a hook that edited files), and after success verifies what landed: the tree against the reviewed tree, every staged path against the commit's first parent, and the cleanup. A mistake here either hides a partial commit or commits a subset silently, which is why the freeze in #588 covers it.

Part of #322, within #588. Child 05 in #322's Children list. Delivers in Go the behavior of the post-copy half of packages/agents/source/skills/commit/shared/scripts/commit.sh, completing agentrepo commit.

Acceptance criteria

1. AC1: Given a staged group, when the commit runs, then the commit is made from the copied message with its body preserved exactly (including a leading number-sign line) and with whitespace cleanup, and in amend mode it amends the head commit.
2. AC2: Given a failed commit where some paths staged before are no longer staged, when it reports, then it lists the dropped paths and tells the operator to stage them again.
3. AC3: Given a failed commit where a hook changed nothing, when it reports, then it says nothing changed and the stamp is untouched; given a hook that changed files, then it says the commit failed on purpose and the review must run again.
4. AC4: Given a landed commit whose tree differs from the reviewed tree, when it verifies, then the commit stays, the command exits 1 and prints the comparison command.
5. AC5: Given staged paths missing from the landed commit, when it verifies, then the command exits 1 and lists them; the paths come from the first parent diff for a merge commit and from the root diff for a first commit.
6. AC6: Given git fails after printing landed paths, when it verifies, then the failure is reported rather than treated as an empty list.
7. AC7: Given a successful commit with everything landed, when it finishes, then it prints the short stat, clears the stamp, the copied message, the review inputs, the verdict and the round state, and exits 0.
8. AC8: Given a base merge, when it commits, then the merge commit's parents and tree are verified through the signing verification delivered by Port the shared skill library (lib.sh, agent.sh, signing.sh, gates.py) to Go #321, and the merge commit is signed.
9. AC9: Given a post-write tree or path mismatch in attended mode, when the command fails, then it behaves as the shell does today for the review state and the copied message, and the stamp and draft recovery evidence is as the shell leaves it.
10. AC10: Given a failed or short commit that did not land, when the command ends, then the stamp and the draft are not removed.

Scope and non-goals

Scope: the commit execution, the failure explanation, the post-commit verification and the cleanup in agentrepo commit.

Non-goal: the unattended signing hold and bounded review rounds, which child 06 delivers. Non-goal: changing hook behavior; the post-commit hook that deletes the draft keeps doing so. Non-goal: duplicating the signing verification, which this child only calls. Non-goal: changing today's retention of the draft after a post-write mismatch. Non-goal: switching any shell wrapper, which child 07 does once.

Approach

Meet AC1 to AC10 with failing cases first, using scratch repositories with real hooks that rewrite the index, edit files or fail, as the existing hook cases do, plus successful message and amend cases that child 04 does not cover. Compare AC9 against the shell's behavior on the same fixtures.

Dependencies

Blocked by: #853.

Prerequisite: the signing verification deliverable of #321.

Size

M. One pull request.

Verify plan

• AC1: tests that commit a body with a leading number sign, amend the head, and check the stored message bytes.
• AC2, AC3: tests with hooks that fail clean, fail after editing, and drop a staged path.
• AC4, AC5: tests with a hook that rewrites the index and a hook that drops a path, including a merge and a root commit.
• AC6: a stub git that prints paths then fails.
• AC7, AC10: tests inspect the stamp, copied message, review inputs, verdict and round state after each outcome.
• AC8: the merge cases from tests/skills/agent-commit/base-merge.bats ported.
• AC9: parity tests against captured shell results after a post-write mismatch.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

The landed-path comparison is the control against a silent partial commit, so any loosening hides it. Undo: revert the change; no caller uses the command until child 07.

Operator authority

None.