Add fail-closed team-local loop

[moonweave]

Summary

• Add python3 -m depone team-local, a minimal local team loop over existing safe primitives.
• Preserve fail-closed behavior: no live model or coding-agent launch, no unlisted shell commands, no merge approval, no assurance raise.
• Commit re-validatable docs/team-local/ machine artifacts plus validate_team_local_run_ledger and a changed-tier docs contract.

Verification

• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_agent_fabric_team_local tests.test_team_local_cli tests.test_agent_fabric_team_dry_run tests.test_agent_fabric_team_launch_preflight tests.test_agent_fabric_team_worktree_prep tests.test_agent_fabric_team_shell_lane_launch tests.test_agent_fabric_team_ledger tests.test_team_launch_preflight_cli tests.test_team_shell_lane_launch_cli -v -> Ran 98 tests OK.
• python3 -m depone team-local --self-test -> pass.
• python3 - <<'PY' ... validate_team_local_run_ledger ... PY -> validate errors: [], decision blocked.
• git diff --check -> pass.
• python3 scripts/dwm.py doctor -> DWM doctor: ok.
• python3 scripts/check_contract.py --tier changed -> contract changed: pass.

Honest residual

The committed docs/team-local fixture is intentionally blocked after the allowlisted shell lane because evidence-next requires a real evidence-run bundle. This PR proves local fail-closed sequencing and re-validatable artifacts, not completed autonomous coding lanes.

[moonweave]

Added team-local pass-lane slice with ordered command_ids, safe runtime token expansion, worktree receipt fan-in, and re-validatable docs/team-local-pass artifacts. Verification: related 111-test suite passed; command self-tests passed; validate_team_local_run_ledger returns []; team-local-pass docs contract passes. Full changed-tier contract reached the new team-local-pass contract but later failed on pre-existing docs/codex-local-capability/capability.json instruction sha256 mismatch in this worker worktree.

[moonweave]

Added team-local pass-lane slice with ordered command_ids, safe runtime token expansion, worktree receipt fan-in, and re-validatable docs/team-local-pass artifacts. Verification: validate_team_local_run_ledger(docs/team-local-pass/team-run-ledger.json) => []; related unittest suite passed (112 tests); self-tests for team-local/evidence-next/team-ledger/worktree-lane-receipt passed; git diff --check passed. Known repo/environment gates: scripts/dwm.py doctor still fails on missing historical out/v7* dogfood dirs/status.json; scripts/check_contract.py --tier changed now reaches existing docs/codex-local-capability/capability.json instruction sha256 mismatch.

[moonweave]

Final team-local pass lane verification:

• OMX team: completed earlier; current status state is cleaned up (omx team status implement-depone-team-74805df1 -> No team state found).
• Independent artifact re-validation:
  decision: pass
  validate errors: []
  team ledger verdict decision: pass
  evidence-next decision: continue
• Focused tests: python3 -m unittest tests.test_agent_fabric_team_local tests.test_team_local_cli -v -> 8 tests OK.
• Whitespace/release text: git diff --check -> pass; python3 scripts/check_release_text.py . -> release text check: pass.
• DWM doctor: python3 scripts/dwm.py doctor -> DWM doctor: ok.
• Changed-tier contract: python3 scripts/check_contract.py --tier changed -> contract changed: pass.
  Honest boundary: local shell lane only; no live coding-agent launch, no live model call, no unlisted shell command, no merge approval, no A2/A3 assurance raise.