fix(bootstrap): address PR #853 REQUEST_CHANGES findings (#850)

- Remove /branches/ string-split fallback in resolve_canonical_repo_root;
  recover roots via commonpath ancestry only (review #531 F2).
- Refuse existing branches that do not contain live master; no weak
  merge-base acceptance (F3).
- Verify caller-supplied assignment_id/lease_id against the control plane
  or fail closed (F4).
- Compensating recovery releases bound workflow leases via lease_lifecycle (F5).
- Regression tests for each finding.

author_mutation_worktree.py

@@ -92,12 +92,31 @@ def resolve_canonical_repo_root(workspace_path: str, fallback_project_root: str)
         except Exception:
             pass
 
+    # Fallback when git metadata is unavailable. Never string-split on
+    # "/branches/" (review #531 Finding 2 / F-6): recover the repo root only
+    # via resolved-path commonpath ancestry against a parent that owns a
+    # real ``branches`` directory containing the fallback path.
     fallback = os.path.realpath(fallback_project_root or workspace_path or ".")
-    norm = fallback.replace("\\", "/")
-    if "/branches/" in norm:
-        return os.path.realpath(norm.split("/branches/")[0])
-    elif norm.endswith("/branches"):
-        return os.path.realpath(os.path.dirname(fallback))
+    cur = fallback
+    for _ in range(64):
+        parent = os.path.dirname(cur)
+        if parent == cur:
+            break
+        branches_dir = os.path.realpath(os.path.join(parent, "branches"))
+        if os.path.isdir(branches_dir):
+            try:
+                if os.path.commonpath([branches_dir, fallback]) == branches_dir:
+                    return parent
+            except ValueError:
+                pass
+        # Also accept fallback itself being the branches directory.
+        if os.path.basename(cur) == "branches" and os.path.isdir(cur):
+            try:
+                if os.path.commonpath([cur, fallback]) == cur:
+                    return parent
+            except ValueError:
+                pass
+        cur = parent
 
     return fallback