FN-6188: harden AI merge temp worktree cleanup

Improve AI merge temp worktree cleanup and add recovery coverage.

- audit AI merge clean-room cleanup success and failure paths, including stderr/code details
- sweep stale fusion-ai-merge temp directories from tmpdir() during self-healing with active-session safeguards
- document the native temp-dir sweep behavior and add merge cleanup/self-healing regression tests

Files changed:
 docs/architecture.md                               |   1 +
 .../engine/src/__tests__/merger-ai-cleanup.test.ts | 169 +++++++++++++++++
 .../__tests__/self-healing-tempdir-sweep.test.ts   | 200 +++++++++++++++++++++
 packages/engine/src/merger-ai.ts                   |  54 +++++-
 packages/engine/src/run-audit.ts                   |  26 +++
 packages/engine/src/self-healing.ts                | 105 +++++++++++
 6 files changed, 551 insertions(+), 4 deletions(-)

Fusion-Task-Id: FN-6188

Fusion-Task-Lineage: eae9bcdc-9765-4104-85dc-81bb50445e99

docs/architecture.md

@@ -670,6 +670,7 @@ Runtime action-gate flow (v1):
 - `TransientErrorDetector` (`transient-error-detector.ts`) — retriable error classification
 - `SelfHealingManager` (`self-healing.ts`) — auto-unpause/maintenance recovery actions
   - Batch 1 maintenance now includes one `fts-maintenance` step for both search indexes. The live `tasks_fts` branch still runs `merge` every tick, `optimize` every 4th tick, and `rebuild` above `32 MiB` or `1 MiB × live task count`. The archive `archived_tasks_fts` branch is lighter because archive writes are mostly append-only: `merge` every 8th tick, `optimize` every 24th tick, and `rebuild` above `64 MiB` or `512 KiB × archived row count`. Each branch is independently guarded by `fts5Available` and emits `task:fts-maintenance` run-audit telemetry with distinct `target` values (`tasks_fts` vs `archived_tasks_fts`).
+  - Batch 1 also sweeps stale AI merge clean-room worktrees under `tmpdir()` whose names start with `fusion-ai-merge-`. The sweep only considers directories older than 2 hours, canonicalizes paths before checking `activeSessionRegistry`, attempts `git worktree remove --force <path>` before filesystem removal, and emits `worktree:tempdir-sweep` run-audit telemetry for removal attempts and failures. It is intentionally native even when `worktrunk.enabled` because these temp-dir worktrees are outside the worktrunk-managed project layout. Fresh directories, active-session paths, and individual removal failures are skipped/logged without aborting the maintenance cycle.
   - `recoverGhostReviewTasks()` is a fallback only for idle, non-terminal `in-review` states. Terminal/actionable states (notably `status: "failed"`) are preserved and **not** auto-kicked back to `todo`.
   - Mission validation has a dedicated stale-run reaper: startup recovery and Batch 2 maintenance call `reapStaleMissionValidatorRuns()` when wired by the runtime, using `VALIDATOR_RUN_STALE_MAX_AGE_MS` (currently 6 hours). The sweep terminates ownerless `mission_validator_runs.status='running'` rows as `error`, writes the reap reason into `summary`, leaves `lastValidatorRunId` pointing at the now-terminal run, and emits run-audit telemetry with `mutationType: "mission:validator-run-reaped"` plus `runId`/`featureId`/`missionId`/`triggerType`/`elapsedMs` metadata. Active mission features move to `loopState="needs_fix"` + `lastValidatorStatus="error"` unless their parent mission is already `complete`/`archived`.