feat(boss): bolder autonomous /boss — grounding-PASS auto-sign, rollback sandbox, reference issue

Retire the obligatory five-lens spec-skeptic auto-sign panel (worst case
18 agent runs per spec under /boss). The autonomous signature is now the
Step-5 grounding-check PASS alone — an independent fresh-context agent's
verdict against currently-green tests; a no-override BLOCK/INFRA_ERROR
routes to the human sign-off pause.

The judgement the panel applied moves upstream into specify Step 1.5,
whose stance inverts: a load-bearing fork the orchestrator can DERIVE an
answer for (sources, code, consistency, risk) is decided boldly and
recorded on the run's reference issue; only a pure-preference fork
bounces. spec-skeptic survives as an optional ad-hoc bias-breaker the
orchestrator pulls when unsure whether its leaning is judgement or bias —
not a gate, not a veto.

Every /boss run carries a mandatory reference issue (created if the cycle
had none): the fork-decision log, the orchestrator's cross-run memory,
and the only surviving trace of a hard-dropped attempt.

Relax main-sacrosanct below the session anchor: within an autonomous run
the orchestrator may git reset --hard its OWN UNPUSHED commits above the
anchor on a dead end — never below the anchor, never a pushed commit
(forward-only/revert). Discarded attempts are hard-dropped, no parking.

Verified across the 9 edited files by a 4-lens adversarial review
(retired-panel residue, cross-file contracts, rollback-boundary safety,
stance coherence): unanimous SOUND. Baseline tagged pre-autosign-rework.

closes #8

templates/CLAUDE.md.fragment

@@ -51,13 +51,19 @@ Two rules govern who touches git history and how:
   tree as unstaged changes. I inspect the result, decide commit
   shape, and commit. Per-task or per-phase commits are not a
   goal in themselves.
-- **main HEAD is sacrosanct.** Nobody (including me) runs
-  `git reset` or `git revert` on main. main moves forward only
-  via my commits. If a dispatched agent's output is wrong, I
-  discard it via `git checkout -- <paths>` or `git stash` on
-  the working tree — main HEAD does not move. If something
-  wrong does land on main, the remedy is a forward-fix commit,
-  never a rewind.
+- **main HEAD is sacrosanct below the session anchor.** Nobody
+  (including me) rewinds user-ratified main history with
+  `git reset` / `git revert`. main moves forward only via my
+  commits. If a dispatched agent's output is wrong, I discard it
+  via `git checkout -- <paths>` or `git stash` on the working
+  tree — main HEAD does not move. If something wrong does land on
+  ratified main, the remedy is a forward-fix commit.
+  **One narrow `/boss` exception (the rollback sandbox):** in an
+  autonomous run I may `git reset --hard` my *own unpushed*
+  autonomous commits — those above the HEAD the run started from
+  (the session anchor) — back toward, never below, that anchor,
+  when I have run into a dead end. A pushed commit has left the
+  sandbox and is forward-only (`git revert`).
 
 ## Spec/plan artefacts are ephemeral