fix(bootstrap): address PR #853 REQUEST_CHANGES findings (#850)

- Remove /branches/ string-split fallback in resolve_canonical_repo_root;
  recover roots via commonpath ancestry only (review #531 F2).
- Refuse existing branches that do not contain live master; no weak
  merge-base acceptance (F3).
- Verify caller-supplied assignment_id/lease_id against the control plane
  or fail closed (F4).
- Compensating recovery releases bound workflow leases via lease_lifecycle (F5).
- Regression tests for each finding.

tests/test_workspace_guard_alignment.py

@@ -35,8 +35,10 @@ class TestCanonicalRepoRoot(unittest.TestCase):
         self.assertEqual(root, CONTROL_ROOT)
 
     def test_falls_back_when_git_unavailable(self):
+        # When fallback is a path under <repo>/branches/<worktree>, recover
+        # <repo> via commonpath ancestry (never string-split on "/branches/").
         root = amw.resolve_canonical_repo_root("/missing/path", MCP_PROCESS_ROOT)
-        self.assertEqual(root, os.path.realpath(MCP_PROCESS_ROOT))
+        self.assertEqual(root, os.path.realpath(CONTROL_ROOT))
 
 
 class TestWorkspaceRepoMembership(unittest.TestCase):