Prove append-only sorted unions in Go #899

Problem

The safety proof at packages/agents/source/skills/resolve-rebase-conflicts/shared/scripts/conflict_shape.py:113 examines complete versions, not marker regions. It refuses to resurrect deleted lines and distinguishes a normal refusal from a broken tool. Both classification and resolution need the same proof before either caller moves.

Part of #588 and #326.

Acceptance criteria

1. AC1: Given three nonempty, nonbinary versions sorted by byte value with unique lines and no ancestor deletions, when a union is requested, then the raw proof result (before any serialization) contains exactly the distinct byte lines from both sides in byte order, with no byte changed.
2. AC2: Given either side removed an ancestor line, when a union is requested, then it refuses instead of restoring that line.
3. AC3: Given an absent, empty, binary, unsorted or duplicate-bearing version, when a union is requested, then it refuses with the frozen reason.
4. AC4: Given a manual declaration, when a union is requested, then it refuses even if the content otherwise qualifies.
5. AC5: Given a union declaration with unsafe content, when a union is requested, then the declaration cannot authorize the result.
6. AC6: Given a normal union refusal, when the compatibility interface returns, then it emits no result and returns refusal status 3.
7. AC7: Given invalid invocation or an operational failure, when the compatibility interface returns, then it remains distinguishable from refusal status 3.
8. AC8: Given missing final newlines or non-UTF-8 content, when the compatibility output is serialized, then its bytes (including replacement decoding of malformed UTF-8) and diagnostic text match the frozen behavior, while the raw proof result of AC1 stays byte-exact so the later independent disk proof can detect a changed byte set.
9. AC9: Non-functional: proof evaluation never changes repository contents or the index.
10. AC10: Non-functional: native proof cases execute without skips on macOS, Linux and Windows.

Scope and non-goals

Scope: stage reading, byte ordering, sorted-union eligibility, result construction and the existing mode/status boundary.

Non-goal: token proposals (child 06), repository classification (child 07), writing/staging a resolution (child 08), or broadening accepted inputs. Keep shell and coupled Python frozen through N-2, with no new shell logic. Do not switch callers or retire tests in this child.

Approach

Port packages/agents/source/skills/resolve-rebase-conflicts/shared/scripts/conflict_shape.py:82 and packages/agents/source/skills/resolve-rebase-conflicts/shared/scripts/conflict_shape.py:246 with native table cases from tests/skills/resolve-rebase-conflicts/scripts/test_conflict_shape.py:61. Retain bytewise ordering and the current replacement decoding of malformed UTF-8 output; the subsequent independent disk proof must still detect a changed byte set. Preserve refusal/misuse/failure separation. Expose only the existing proof contract needed by the later commands, with no new general-purpose resolver API.

Dependencies

Blocked by: #753, before command registration.

No whole-area #321 dependency for the pure proof.

Size

M. Forecast 580 code lines: 220 implementation, 310 tests and fixtures, 50 command integration. Measured helper baseline: 212 code lines total; this child owns its stage/union portions only. Prose allowance: 180 lines.

scc could not run in the isolated checkout. Measured baselines count non-blank lines other than full-line # comments, including Python docstrings and embedded code conservatively. Forecasts include implementation, tests, fixtures and registration; they are estimates, not measured future Go. Generated output is excluded only under packages/agents/claude/.apm/skills/, packages/agents/codex/.apm/skills/, .claude/skills/, .agents/skills/ and tokens.json. The source under packages/agents/source/ and copies anywhere else count. The final diff must be at most 800 code lines and 2,000 prose lines, with no exception; split before implementation if either forecast grows beyond its limit.

Verify plan

• AC1, AC2, AC3, AC4, AC5: table tests assert on the raw proof result, never the serialized output, and cover safe unions, independent additions, shared additions, deletions, each invalid-stage condition and declaration precedence.
• AC6, AC7: command-level tests compare status, stdout and stderr for success, refusal, bad arguments and injected read failure against the frozen helper.
• AC8: byte fixtures cover no final newline, CRLF, empty lines, non-ASCII and invalid UTF-8; compare exact serialized output and diagnostics. The invalid UTF-8 fixture is also asserted under AC1: the raw proof result keeps the original bytes while the serialized output shows replacement decoding.
• AC9: snapshot content and index around evaluation.
• AC10: inspect executing native proof cases on each CI platform.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

Unicode normalization or treating an empty stage as an empty set can change eligibility or lose bytes. Undo: revert the unused Go proof; the frozen helper remains authoritative until activation.

Operator authority

None.