feat(FN-4948): complete Step 2 — wire identity guard into worktree provisioning

Fusion-Task-Id: FN-4948
Fusion-Task-Lineage: dc622643-4c3e-4217-9219-a6a6e5424427

packages/engine/src/step-session-executor.ts

@@ -29,6 +29,7 @@ import type { AgentActionGateContext } from "./agent-action-gate.js";
 import type { SkillSelectionContext } from "./skill-resolver.js";
 import { generateWorktreeName } from "./worktree-names.js";
 import { resolveTaskWorktreePath } from "./worktree-paths.js";
+import { installTaskWorktreeIdentityGuard } from "./worktree-hooks.js";
 import { AgentSemaphore } from "./concurrency.js";
 import { StuckTaskDetector } from "./stuck-task-detector.js";
 import { AgentLogger } from "./agent-logger.js";
@@ -1345,6 +1346,11 @@ Follow instructions precisely and avoid unrelated changes.`,
       throw err;
     }
 
+    await installTaskWorktreeIdentityGuard({
+      worktreePath,
+      taskId: this.options.taskDetail.id,
+    });
+
     this.registerParallelWorktree(stepIndex, worktreePath);
     this.parallelBranches.set(stepIndex, branchName);