fix(ship): agent-mode arch debate, --until, false-green/noisy gates, and hook GIT_DIR isolation (for v1.10.8)

[teragrid]

What

Fixes and one addition found by driving forge ship --agent-mode through the spec and arch checkpoints of a real feature on a Next.js/Supabase + Python two-repo system, plus a hook bug found while pushing this very change.

Fixed

• arch debate discarded answers (bug). In agent mode checkArch wrote arch.md with (no concerns raised) for all six roles while the first debate turn was still owed. The next run hit the "arch.md exists" shortcut, so the debate never resumed and the submitted answer was lost. It now pauses without writing and asks each role in turn.
• arch prompt vs adr-quality-gate. The prompt never asked for alternatives; the gate fails an ADR with fewer than two. The prompt now asks for an Alternatives Considered section.
• ship false green. ship reported ok plus "spec-vs-code audit found no blocking gaps" on a branch with no source changes. It now warns ("nothing to ship") and withholds the claim; unknown git state keeps the old behaviour (new gitservice.ChangedFilesOnBranch).
• test checkpoint count. Reported the whole repo's test-file count. It now reports the feature's own tests and warns when it has none.
• agent-mode banner no longer says YOLO when --yolo was not passed.
• unverified-file-reference check flagged cross-repo citations as hallucinated. forge.yml related_repos now resolves them and lists sibling repos in the workspace context.
• workspace context detects frameworks (Next.js, Supabase, TypeScript, ...) from package.json / tsconfig.json / supabase/; the feature being planned is no longer listed as an existing spec.
• failure history in spec prompts is scoped to the current feature (recent others only) and de-duplicated.
• pre-push hook / gitservice inherited git's exported GIT_DIR. Tests that shell out to git in a temp dir therefore ran against the repository being pushed: they committed fixtures onto the pushed branch, force-renamed branches (overwriting main) and rewrote .git/config (core.bare, user.name). The hook now unsets the repo-pointing variables, and gitservice no longer passes them to the git processes it starts. Regression test verified to fail without the change; the fixed hook was also exercised end to end against a throwaway clone and remote (all 13 stages green, refs and config unchanged).

Added

• forge ship --until <checkpoint> — stop after the named checkpoint so spec/arch can be reviewed before test/breakdown/code exist.

Deliberately not changed

• self-review-gate reporting UNVERIFIED on a first run (its docstring says scanning zero files is not a clean bill of health).

Verification

• New regression tests for every change; the arch-debate and GIT_DIR tests were confirmed to fail without their fixes.
• go test ./... — 77 packages ok; golangci-lint clean on the changed packages; all 13 pre-push stages pass.
• End to end with the built binary in a scratch repo: --until arch asked all six debate roles in turn, kept all six answers (0 placeholders), and wrote no test/breakdown/code/ship stubs.

🤖 Generated with Claude Code