fix(FN-5456): never create task branches from arbitrary HEAD in autocorrect

`attemptBranchAutocorrect` was the only branch-creation site in the
engine that ran `git checkout -B <expected>` without a start point.
When the worktree's HEAD was at a previous occupant's tip, the new
label silently captured that commit — the "branch: Created from HEAD"
contamination pattern that the cross-contamination guard then refuses
to auto-resolve (see FN-5456: orphan FN-5477 commit 268574b9a stranded
on fusion/fn-5456).

Replace the unsafe fallback with verify-then-`git checkout`: only switch
to an existing expected ref; return `failed` when it does not exist so
upstream recovery — which knows the proper base SHA — can re-anchor via
`prepareForTask` / `reanchorBranchToBase`.

Tests updated for the new command sequence; new case covers the
"expected ref missing → fail without creating from HEAD" guarantee.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/engine/src/branch-autocorrect.ts

@@ -82,7 +82,17 @@ export async function attemptBranchAutocorrect({
     }
   }
 
-  const checkout = await runGit(`git checkout -B ${expectedArg}`, worktreePath);
+  // FN-5456: must NOT use `git checkout -B` with no start point — that would
+  // create (or reset) the expected branch at whatever HEAD currently is,
+  // capturing the previous occupant's tip (the "branch: Created from HEAD"
+  // contamination pattern). Plain `git checkout` only switches to an existing
+  // ref; if `expected` doesn't already exist the caller will surface a
+  // wrong-branch failure with proper base resolution upstream.
+  const verifyExpected = await runGit(`git rev-parse --verify --quiet ${expectedArg}`, worktreePath);
+  if (!verifyExpected.ok) {
+    return { status: "failed", reason: `expected branch ${expected} does not exist` };
+  }
+  const checkout = await runGit(`git checkout ${expectedArg}`, worktreePath);
   if (checkout.ok) {
     return { status: "checked-out" };
   }