fix(FN-3716): stabilize verification and role policy checks

- Add shared agent role policy helpers for implementation task detection and executor-role enforcement
- Provide a standardized role-mismatch error formatter for delegation and assignment paths
- Update test isolation leak detection to ignore ephemeral fusion-test-home-root temp directories while preserving baseline checks

Fusion-Task-Id: FN-3716

scripts/check-test-isolation.mjs

@@ -205,7 +205,15 @@ function checkAgainstBaseline() {
     .map((name) => name.trim())
     .filter(Boolean);
   for (const name of callerIgnoreNames) baselineNames.add(name);
-  const leaks = snapshotTmp().filter((e) => !baselineNames.has(e.name));
+  const leaks = snapshotTmp().filter((e) => {
+    if (baselineNames.has(e.name)) {
+      return false;
+    }
+    if (e.name.startsWith("fusion-test-home-root-")) {
+      return false;
+    }
+    return true;
+  });
 
   const baselineByDir = new Map((baseline.protectedFusion ?? []).map((entry) => [entry.dir, entry]));
   const unstableProtectedDirs = new Set(baseline.unstableProtectedDirs ?? []);