builder: clean-tree-before-claim discipline (git status must be clean — Adversary cold-verifies from git)

Cheap guard against the deploy/git divergence: a fix built locally but uncommitted/un-pushed is a
guaranteed Adversary cold-build mismatch. Added to the builder prompt claim discipline + plan.md
§6.1. (Lighter than binding the deploy to a git rev — iteration speed + the Adversary's
cold-from-git verify is the real safety net.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cc-ci-plan/plan.md

@@ -648,6 +648,10 @@ its own pacing. To make concurrent writes conflict-free:
     Builder. So the prefixes are **load-bearing** — a gate claim MUST be a `claim(...)` commit and a
     verdict MUST be a `review(...)` commit, or the counterpart isn't promptly woken (it falls back to
     its slower self-poll). STATUS/REVIEW remain the durable source of truth; the prefix is the signal.
+  - **Clean tree before claim.** The Builder runs `git status` before claiming — the working tree
+    must be clean (everything committed AND pushed). The Adversary cold-verifies from a fresh clone,
+    so an uncommitted/un-pushed change that only exists on the Builder's host (e.g. a locally-built
+    fix) is a guaranteed cold-verify mismatch. Commit + push first, then claim.
 - **DONE handshake.** Builder may write `## DONE` to `STATUS.md` **only** when `REVIEW.md` shows a
   PASS dated within 24h for every D1–D10. The Adversary can write `## VETO <reason>` to
   `REVIEW.md` at any time, which forbids DONE until cleared.