fix(engine): skip promoted-foreign commits in contamination audit

assertCleanBranchAtBase now checks each foreign-attributed commit
against `git merge-base --is-ancestor <sha> main`. If the commit is
already on local main, it was promoted through integration regardless
of whose Fusion-Task-Id trailer it carries — treating it as foreign
contamination is wrong and was the root cause of the FN-5475 cascade
(downstream worktrees inherited a sibling task's tip during the brief
fast-forward window before main moved further).

Audit cost: O(N) extra git calls per audit run, where N is the number
of foreign-trailer commits in baseSha..branchName. Each call is ~5-10ms
and N is typically 1-5. Negligible relative to the surrounding I/O.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.changeset/fix-engine-audit-promoted-foreign.md

@@ -0,0 +1,25 @@
+---
+"@fusion/engine": patch
+---
+
+fix(engine): treat foreign-attributed commits already on main as promoted
+
+`assertCleanBranchAtBase` flagged any commit in `baseSha..branchName`
+whose `Fusion-Task-Id` trailer pointed at a different task as
+contamination. That misclassified the FN-5475 cascade: the engine
+fast-forwards local `main` with single-parent task commits, and any
+worktree created during the brief window where local `main` carried a
+sibling task's tip inherited that commit. The audit later (correctly)
+saw the commit as not-yet-on-main from its merge-base perspective and
+threw `BranchCrossContaminationError`.
+
+The audit now skips foreign-attributed commits that are reachable from
+local `main` (`git merge-base --is-ancestor <sha> main`). Commits on
+main were promoted through integration regardless of whose trailer
+they carry, and downstream branches that inherited them via main are
+not contaminated.
+
+Resume verifier (FN-5475 fix #2) and the auto-recovery handler
+fallback (FN-5475 fix #3) remain in place as defense-in-depth for
+the rarer variants (local main rewound, foreign commit not yet on
+main when the audit fires).