Post-merge fixes after rebasing the distributed worker pool onto the
review-goal-semantics train tip:
- Pool SCM submission tests target the train's relocated receive-pack
scanner: FEATURE_REF_RE now lives in receive_pack_scan, bodies are
built via the shared _receive_command helper (valid pack), and the
update-rejection assertion matches the train's message.
- Take the train's canonical test_hermes_scm_broker,
test_hermes_cli_dispatch_runtime and test_hermes_cli_execution_edges,
which exercise the train's broker/dispatch/execution behavior.
- Runtime staging tests patch os.fchown alongside os.chown so the
UID-10000 _write_secret path passes under a non-root gate runner
(production ownership behavior unchanged).
- Split the jenkins build-evidence contracts out of
test_hermes_runtime_access into test_hermes_runtime_evidence to keep
both files under the 500-LOC hygiene ceiling after the merge.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
