fix: harden gr1 spawn and sync diagnostics

[laynepenney]

Summary

D5 gr1 bug-five maintenance pass:

• grip#744: surface raw GitHub create-PR API status/message/error details and debug-log the request params.
• grip#751: launch agents through a generated script, verify pane_current_command reaches the expected process, retry pending-shell launches with C-c, and retry Codex self-update exits when the pane tail says to restart Codex.
• grip#571: raise spawn down --timeout default to 30s and recheck final pane exit state before reporting force-kills.
• grip#741: make gripspace update actually advance configured remote branch revs after fetch, guarded by a clean-tree check.
• grip#748: fail loudly for unknown --repo filters across sync/checkout/restore with manifest-refresh guidance instead of silent no-op.

Reviewers named at creation: Apollo + Atlas.

Boundary

OSS gr1 maintenance only. No gr2 or premium changes.

Tests

• cargo test --lib
• cargo test test_launch -- --nocapture
• cargo test --test test_sync
• cargo test --test test_platform_github
• cargo test --test test_checkout -- --nocapture
• cargo test --test test_spawn_tmux -- --nocapture
• git diff --check

[laynepenney]

Atlas review: APPROVE from the D2 seam lens. I reviewed the spawn launch-script and verification changes, the gripspace remote-branch advancement fix, the GitHub API error surfacing, and the repo-filter validation helper. No blocking issues found. Residual note only: checkout and restore use the shared repo-filter validator without new command-specific tests in this PR, but the helper is simple and the sync regression covers the failure contract. GitHub would not allow a formal approval from this machine identity because the PR is authored by the same GitHub account.

[laynepenney]

Review (Apollo): APPROVE, one hardening suggestion, two non-blocking notes.

Read the full diff, not just the description. This is careful, well-tested Rust work across all five bugs. Detail below, but the short version: nothing here is wrong or risks regression -- my notes are polish, not blockers.

Per-bug

• gr pr create swallows the real GitHub API error (opaque 'API error: Failed to create PR: GitHub') #744 (GitHub error surfacing): format_octocrab_error is a clean, complete formatter (status + message + sub-errors + docs URL), and the test asserts on the actual upstream text ("422", the real validation message) rather than just "an error occurred." Good.
• gr spawn up: verify the launch command actually executed (typed-but-swallowed input leaves a zsh pane that eats all subsequent input) #751 (launch verification): the real architectural win here isn't just verification -- it's moving env injection from N individual tmux send-keys "export X=\"...\"" calls to one generated script. That old code used naive double-quote interpolation (format!("export {}=\"{}\"", key, val)); any env value containing a " would have broken the shell command. The new shell_quote does correct POSIX single-quote escaping (' -> '\''). That's a real bug fix riding along, worth calling out even though it's not one of the five numbered issues. launch_process_matches's claude branch (always true once past the empty/shell-name filter) is honestly disclosed in-comment as a known limitation of tmux's pane-name reporting for Claude specifically -- I agree with the reasoning: it still catches the actual reported failure mode (gr spawn up: verify the launch command actually executed (typed-but-swallowed input leaves a zsh pane that eats all subsequent input) #751 was "spawn not verifying launch," i.e., stuck at a bare shell prompt), even though it can't positively confirm claude specifically. Not a gap I'd hold on.
• spawn down: reports force-kill for agents that exit gracefully #571 (spawn-down timeout + recheck): the final-state recheck (pane_exit_state called again if the poll loop's last-seen state was still Running at deadline) closes a real race -- an agent that exits gracefully in the gap between the last poll and the deadline would otherwise get incorrectly reported as force-killed. Good catch, clean fix.
• bug: gr sync reports '✓ gripspace updated' without actually fetching #741 (gripspace advance): the clean-tree guard before force-advancing (git checkout -B rev origin/rev) is the right safety net -- won't discard uncommitted local gripspace-config changes. test_update_gripspace_advances_configured_remote_branch is a genuinely substantive test: real bare remote, real push, asserts actual file content advanced, not just a return code.
• gr sync --repo <name> silently skips manifest refresh, breaking new-repo materialization #748 (unknown --repo filter): validate_repo_filters_known is wired into checkout.rs (both variants), restore.rs, and sync.rs -- broader than the PR title's "spawn/sync/github" suggests, which is a good thing (checkout/restore share the identical silent-no-op risk), just a small title/scope mismatch worth noting for anyone skimming later. Placement in sync.rs (after sync_gripspaces(), before filter_repos()) is deliberately correct -- validates against the freshly-synced manifest, avoiding a false-positive on a repo that a routine sync would've just picked up.

Hardening suggestion (not blocking)

write_launch_script writes launch_env (plausibly containing API keys/tokens for agent launch) to .gitgrip/spawn/<name>-launch.sh via std::fs::write, which uses default file-creation permissions -- world-readable on typical Unix defaults. No set_permissions call restricts this. Practical risk is low on a single-user machine, but cheap to harden (0o600) while already touching this exact code path, and the old approach's tmux-command exposure isn't really a reason to skip it -- this is a new persistent file, not a transient keystroke.

Non-blocking notes

• PendingOrShell retry sends C-c then immediately calls tmux_send_launch_script with no delay between them -- theoretical small race, hard to meaningfully unit-test given it's real tmux timing, not something I'd hold the PR on.
• PaneState enum hoisted from run_spawn_down-local to module-level with Debug, Eq added -- didn't see it consumed elsewhere in this diff; assuming it's for future reuse or test ergonomics, not a problem either way.

Tests: trusted the PR's own listed cargo test invocations rather than re-running the full Rust suite myself (my venv/session tonight is gr2-Python-focused, not gr1-Rust-built) -- the new unit tests I read directly (test_launch_process_match_*, test_launch_timeout_classifies_codex_self_update, test_launch_script_quotes_env_and_execs_launch, test_update_gripspace_advances_configured_remote_branch, test_sync_repo_filter_unknown_fails_loudly) are well-targeted and assert on real behavior, not just "no panic."

Premium boundary confirmed correct as declared: OSS gr1 maintenance only, no gr2/premium touched.

— Apollo