fix(session): require config-backed mutation authority and workspace-bound targets (#714)

Close the #714 remediation gap left at 943d402 where env-only mutation
profiles, REMOTES Timesheet defaults treated as explicit caller input, and
machine-dependent Git remotes produced false greens.

- Fail closed when mutations lack a config-backed profile with non-empty
  allowed_repositories; env ops cannot invent mutation authority.
- Preserve omitted-vs-explicit org/repo provenance through the mutation
  gate; omitted targets bind to the verified workspace repository.
- Prefer workspace-aligned Git remotes over historical Timesheet defaults
  in MCP _resolve and CLI resolve_remote.
- Centralize deterministic config-backed mutation fixtures; migrate
  mutation tests off env-only authority without weakening security
  assertions.

Full suite: 2744 passed, 6 skipped.

session_context_binding.py

@@ -361,27 +361,55 @@ def format_repository_slug(org: str | None, repo: str | None) -> str | None:
     return f"{left}/{right}"
 
 
-def declared_allowed_repositories(profile: Mapping[str, Any] | None) -> list[str]:
+def declared_allowed_repositories(
+    profile: Mapping[str, Any] | None,
+    *,
+    strict: bool = False,
+) -> list[str]:
     """Canonical ``owner/repository`` authorization boundary declared by *profile*.
 
     This list is an authorization boundary, never the session binding itself:
     the verified workspace selects exactly one entry (see
-    :func:`assess_repository_scope`).  Returns ``[]`` when the profile declares
-    no scope — enforcement is opt-in per profile so existing static-profile
-    namespaces stay functional until an operator provisions the field.
+    :func:`assess_repository_scope`).
+
+    When *strict* is true (mutation path), missing profile, non-list values, or
+    any malformed entry raise ``ValueError`` instead of silently collapsing to
+    an empty scope (which would fail open). Read-only diagnostics may use
+    strict=False.
     """
     if not profile:
+        if strict:
+            raise ValueError(
+                "profile unresolved; cannot declare allowed_repositories "
+                "(fail closed)"
+            )
         return []
     raw = profile.get("allowed_repositories")
+    if raw is None:
+        return []
     if not isinstance(raw, (list, tuple)):
+        if strict:
+            raise ValueError(
+                "allowed_repositories must be a list of owner/repository slugs "
+                "(fail closed)"
+            )
         return []
     slugs: list[str] = []
+    errors: list[str] = []
     for entry in raw:
         if not isinstance(entry, str):
+            errors.append(f"non-string allowed_repositories entry {entry!r}")
             continue
         parsed = parse_repository_slug(entry)
-        if parsed:
-            slugs.append(f"{parsed[0]}/{parsed[1]}")
+        if not parsed:
+            errors.append(
+                f"malformed allowed_repositories entry {entry!r} "
+                "(expected owner/repository)"
+            )
+            continue
+        slugs.append(f"{parsed[0]}/{parsed[1]}")
+    if strict and errors:
+        raise ValueError("; ".join(errors) + " (fail closed)")
     return slugs
 
 
@@ -390,16 +418,34 @@ def assess_repository_scope(
     workspace_slug: str | None,
     allowed: list[str] | None,
     profile_name: str | None = None,
+    require_scope: bool = False,
 ) -> dict[str, Any]:
     """Authorize the verified workspace repository against the profile allowlist.
 
     The workspace-derived slug is the only candidate: a profile that authorizes
     several repositories still binds to the single verified one, and never to
     the list as a whole.
+
+    *require_scope* (mutation path): missing/empty allowlist fails closed. The
+    workspace remote cannot self-authorize without a configured boundary.
     """
     scope = list(allowed or [])
     reasons: list[str] = []
+    name = profile_name or "(active profile)"
     if not scope:
+        if require_scope:
+            reasons.append(
+                f"mutation denied: profile '{name}' has no non-empty "
+                "allowed_repositories authorization boundary (fail closed)"
+            )
+            return {
+                "proven": False,
+                "block": True,
+                "reasons": reasons,
+                "scope_enforced": True,
+                "workspace_slug": workspace_slug,
+                "allowed_repositories": [],
+            }
         return {
             "proven": True,
             "block": False,
@@ -408,7 +454,6 @@ def assess_repository_scope(
             "workspace_slug": workspace_slug,
             "allowed_repositories": [],
         }
-    name = profile_name or "(active profile)"
     if not workspace_slug:
         reasons.append(
             f"no verified workspace repository could be established for profile "