fix(FN-3716): stabilize verification and role policy checks

- Add shared agent role policy helpers for implementation task detection and executor-role enforcement
- Provide a standardized role-mismatch error formatter for delegation and assignment paths
- Update test isolation leak detection to ignore ephemeral fusion-test-home-root temp directories while preserving baseline checks

Fusion-Task-Id: FN-3716

packages/core/src/agent-store.ts

@@ -55,6 +55,7 @@ import {
 import type { RunMutationContext } from "./types.js";
 import type { TaskStore } from "./store.js";
 import { computeAccessState } from "./agent-permissions.js";
+import { canAgentTakeImplementationTask, formatRoleMismatchReason } from "./agent-role-policy.js";
 import { resolveEffectiveAgentPermissionPolicy } from "./agent-permission-policy.js";
 import { Database } from "./db.js";
 import { createAgentRunSnapshot, createAgentSnapshot, validateSnapshotEnvelope, type AgentRunSnapshot, type AgentSnapshot } from "./shared-mesh-state.js";
@@ -1320,6 +1321,10 @@ export class AgentStore extends EventEmitter {
       return { ok: false, reason: "paused", task };
     }
 
+    if (!canAgentTakeImplementationTask(agent, task)) {
+      return { ok: false, reason: formatRoleMismatchReason(agent, task), task };
+    }
+
     if (task.column === "done" || task.column === "archived") {
       return { ok: false, reason: "terminal", task };
     }