fix(FN-5304): guard against silent no-op landed-file attribution mismatches

- Add a merger guard that verifies source fusion/FN branch attribution when rebase capture reports zero own commits
- Fail finalize with explicit no-op attribution mismatch handling instead of marking mergeConfirmed on ambiguous no-op ranges
- Type and emit dedicated audit events for mismatch and source-ref-unavailable skip diagnostics
- Expand branch attribution, merger, and reliability interaction tests to cover the full no-op guard matrix

Fusion-Task-Id: FN-5304

packages/engine/src/__tests__/reliability-interactions/landed-files-attribution.test.ts

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { execSync, spawnSync } from "node:child_process";
 import { captureRebaseLandedFilesForTask, sumShortstatsForCommits } from "../../merger.js";
-import { filterFilesToOwnTaskCommits } from "../../branch-attribution.js";
+import { filterFilesToOwnTaskCommits, SilentNoOpAttributionMismatchError } from "../../branch-attribution.js";
 
 const hasGit = spawnSync("git", ["--version"], { stdio: "pipe" }).status === 0;
 const describeIfGit = hasGit ? describe : describe.skip;
@@ -91,6 +91,32 @@ describeIfGit("FN-5103 reliability interaction: landed-files attribution", () =>
     expect(capture.deletions).toBe(0);
   });
 
+  it("FN-5304: refuses no-op fast-path when source branch tip still carries own commits", async () => {
+    const { repoDir, baseSha } = await initRepo("fn-5304-ri-");
+    dirs.push(repoDir);
+    const taskId = "FN-5304";
+
+    git(repoDir, `git checkout -b fusion/${taskId.toLowerCase()}`);
+    await commitFile(repoDir, "task-owned-a.ts", "a\n", "fix(FN-5304): owned A", taskId);
+    await commitFile(repoDir, "task-owned-b.ts", "b\n", "fix(FN-5304): owned B", taskId);
+
+    git(repoDir, "git checkout main");
+    await commitFile(repoDir, "upstream-a.ts", "u\n", "fix(FN-9999): upstream A", "FN-9999");
+    await commitFile(repoDir, "upstream-b.ts", "v\n", "fix(FN-9999): upstream B", "FN-9999");
+
+    const recordedSha = git(repoDir, "git rev-parse HEAD");
+
+    await expect(
+      captureRebaseLandedFilesForTask({
+        rootDir: repoDir,
+        rebaseMergeBaseSha: baseSha,
+        recordedSha,
+        taskId,
+        sourceBranchRef: `fusion/${taskId.toLowerCase()}`,
+      }),
+    ).rejects.toBeInstanceOf(SilentNoOpAttributionMismatchError);
+  });
+
   it("surfaces attribution failure when git reads fail", async () => {
     const { repoDir, baseSha } = await initRepo("fn-5103-ri-");
     dirs.push(repoDir);