perf(merger): skip redundant in-merge verification and lockfile-stable installs

Two cuts to wasted work in the merge verification loop:

1. After the in-merge fix agent runs, fingerprint the working tree
   (`git diff HEAD` + `git status --porcelain`, sha256). If the post-fix
   fingerprint matches pre-fix and is non-empty, the agent didn't actually
   change anything — re-running the same failing command can only yield
   the same failure, so log and report the attempt as unsuccessful without
   paying the test/build cost. Empty fingerprints (snapshot tooling failed)
   fall through to the existing re-run path so we never silently swallow a
   real fix.

2. Inside `syncDependenciesForMerge`, hash the active lockfile and compare
   against `node_modules/.fusion-install-marker` (written after each
   successful install). When they match, skip `pnpm install
   --frozen-lockfile` even if `package.json` is staged. Covers the common
   case where `package.json` changes but the lockfile doesn't, and
   amortizes install across auto-recovery re-enqueues that hit the same
   worktree.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.changeset/merger-skip-redundant-verification.md

@@ -0,0 +1,18 @@
+---
+"@runfusion/fusion": patch
+---
+
+Reduce redundant test/build runs during merge verification:
+
+- **Skip the verification re-run after a no-op in-merge fix.** When the fix
+  agent doesn't actually modify the working tree (compared via a git
+  `diff HEAD` + `status --porcelain` content fingerprint), there's nothing
+  new to verify. The merger now logs "fix agent made no changes — skipping
+  verification re-run" and records the attempt as failed without paying the
+  multi-minute test/build cost.
+- **Skip `pnpm install --frozen-lockfile` when the lockfile hash hasn't
+  changed since the last successful install.** A `node_modules/.fusion-install-marker`
+  file records the lockfile SHA-256 after a successful install; subsequent
+  merge attempts in the same worktree skip install when the lockfile content
+  is unchanged, even when `package.json` is staged. Existing
+  `shouldSyncDependenciesForMerge` filtering still applies as a first gate.