feat(verbs): IPostconditionVerifier shared abstraction (Move #3, absorbs #193)

[PolyphonyRequiem]

Summary

Introduces IPostconditionVerifier — a shared, injectable check for "after this verb returns, origin must hold blob X at path Y". This is the Class B bug pattern that produced #192 (manifest commit-and-push silently no-oping when local HEAD already had the blob but origin didn't).

This PR absorbs and supersedes #193 — #193's fix to ManifestCommands.CommitAndPush becomes a one-line postconditions.VerifyAsync(...) call once the abstraction is in place, and the same fix is applied to PlanCommands.CommitAndPush (which had the identical Class B bug shape).

Closes #192.

What IPostconditionVerifier does

Task<PostconditionOutcome> VerifyAsync(
    string branch,
    IReadOnlyList<PostconditionExpectation> expectations,
    string remote = "origin",
    CancellationToken ct = default);

Returns a discriminated union with three cases:

Case	Meaning	Caller's typical action
Satisfied	Origin holds expected blob at every path.	Emit no-op success.
NeedsPush	Origin missing one or more paths.	Push HEAD.
Conflict	Origin has different content for some paths.	Push (let git reject as non-ff) or escalate.

Treats git fetch failure (most common: ref doesn't exist yet — first push of a fresh branch) as NeedsPush so the recovery path runs. Per-path read failures are treated the same way — push and let the real failure surface there if anything is actually broken.

Consumers refactored

Consumer	Before	After
ManifestCommands.CommitAndPush	Inline git fetch + git show guard added in #193	postconditions.VerifyAsync(...) switch
PlanCommands.CommitAndPush	Silent no-op when nothing staged (the #192 bug, just for plan files)	Same verifier switch

Both verbs also now follow the Move #2 routing-style envelope: sentinel int/string defaults, in-body validation, exit 0 with error_code on every failure path — never ConfigError or RoutingFailure.

Discriminated union shape

PostconditionOutcome mirrors RebaseOutcome (in Infrastructure/Processes/): abstract record + sealed nested record cases. Consumers switch with a default arm that throws — the compiler can't prove exhaustiveness across the assembly boundary, and a future case must fail loudly.

Tests

• PostconditionVerifierTests — full unit coverage of all three outcome cases, fetch-failure recovery, show-failure recovery, vacuous case (empty expectations → Satisfied without fetch), byte-exact comparison.
• ManifestCommandsCommitAndPushTests — fully rewritten. Uses the real PostconditionVerifier(GitClient(runner)) to exercise the full fetch+show plumbing. Absorbs all 5 of fix(manifest): guard commit-and-push no-op against stale origin (#192) #193's test scenarios plus a Conflict-path test plus a sentinel-default test.
• PlanCommandsCommitAndPushTests — fully rewritten. Uses FakePostconditionVerifier to drive switch arms without re-stubbing fetch+show (that's covered by the verifier's own tests). Adds Class-B-parity tests for the LocalCleanButOriginMissing and LocalCleanButOriginConflict cases.
• CwdSerialCollection — new xUnit collection that serializes test classes that mutate Environment.CurrentDirectory (avoids races between Manifest and Plan commit-and-push test classes both wanting to chdir into a temp dir).
• FakePostconditionVerifier — test fixture for verbs that don't need the real verifier wiring.

Total: 2880 unit tests pass, 101 Pester tests pass, jinja-resolver lint clean.

Skill doc

Adds a Post-condition verification — when origin must hold blob X section to .github/skills/polyphony-cli-developer/SKILL.md with a worked example showing the verifier-switch pattern.

After merge

• Close fix(manifest): guard commit-and-push no-op against stale origin (#192) #193 with a comment pointing here.
• Delete sdlc/fix-manifest-commit-push-remote-guard.