fix(#3842): stage the emitted-drift-ack sweep so it does not conflict in-flight PRs (#3847)

* fix(#3842): stage the emitted-drift-ack sweep around open PRs

The guard-no-ack-on-next sweep (#3078) deleted every all-spent fragment
under tests/emitted-drift-acks/ unconditionally. When an open PR still
modified the same fragment file, that delete became a modify/delete
conflict on the PR's next merge attempt -- the exact shared-file
conflict fragments were adopted (#2914) to eliminate, reintroduced by
the sweep itself. The first real sweep hit three open, outside-
contributor PRs simultaneously (#3330, #3774, #3648), each with the
swept fragment as its only conflicting path.

assertNoAllSpentFragments now accepts an optional openPrTouchedPaths
set (or the sentinel 'unknown') and partitions all-spent fragments
into "safe to sweep" and "held" -- a held fragment is reported
informationally, never as a failure, and is swept once the touching
PR merges or closes. fetchOpenPrTouchedAckPaths computes the touched
set with a single `gh pr list --json number,files` call. The guard-next
codepath is factored out of main() into the exported, dependency-
injectable runGuardNext() so this wiring is unit-testable without a
real, network-dependent `gh` binary.

The new behavior is strictly opt-in via a --defer-to-open-prs flag,
wired only from the guard-no-ack-on-next job in test.yml (which also
gains pull-requests: read and a GH_TOKEN env for the `gh` call). Every
pre-#3842 caller -- including every existing test -- is unaffected
when the flag is omitted.

CONTRIBUTING.md's "Why fragments, not one file (#2914)" section now
documents the staged-sweep policy so it no longer reads as though
fragments are unconditionally conflict-free once spent.

Refs #3842
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#3842): unify the failed-open-PR-check message to one greppable phrase

The remote matrix (commit 4ec4527fb) failed two tests on the fail-closed
path: assertNoAllSpentFragments's 'unknown' sentinel branch described the
failure as "...could not be determined this run...", while runGuardNext's
catch around fetchOpenPrTouchedAckPaths described the same condition as
"open-PR check failed (<err>)". Both messages were genuinely present and
informative (not missing or empty), but they used different wording for
the same fail-closed condition, so there is no single string a human
scanning CI output can search for to find out why nothing got swept.

Unify both sites on "open-PR check unavailable" -- runGuardNext's line
now reads "open-PR check unavailable — <err.message>", and
assertNoAllSpentFragments's holdAll message now leads with "deferred
(open-PR check unavailable): ...". This is a real fix to the fail-safe
path's diagnosability, not a relaxed test assertion: the two now-failing
tests already expected this exact phrase, and the fix makes the code
say what the tests (correctly) expected instead of loosening them to
match arbitrary prior wording.

Refs #3842
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(#3842): backfill changeset PR number and retype to Fixed

pr:0 backfilled to 3847. Retyped Changed -> Fixed: the change repairs broken sweep behaviour rather than adding any, and its contributor-facing documentation lives in CONTRIBUTING.md at the repo root, which lint-docs-required does not count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

CONTRIBUTING.md

@@ -1120,6 +1120,22 @@ too. If you ever see the legacy file present on `next`, delete it; do not try to
 well-formed. If the job names a spent fragment, run the `git rm` it prints — that is the
 whole remedy, and there is nothing to regenerate.
 
+**The sweep is staged around open PRs, not unconditional (#3842).** A fragment being
+all-spent is necessary but not sufficient to sweep it: deleting a fragment that an OPEN
+pull request still modifies hands that PR a `modify/delete` conflict on its very next
+merge attempt — precisely the shared-file conflict fragments were adopted to end, just
+reintroduced by the sweep itself. This actually happened the first time the sweep ran:
+#3330, #3774, and #3648 all conflicted simultaneously, each with the swept fragment as its
+*only* conflicting path, all three outside contributors. So `--guard-next` now also takes
+`--defer-to-open-prs` (passed by the `guard-no-ack-on-next` job): it runs one `gh pr list
+--json number,files` call, and any all-spent fragment an open PR's file list still names
+is *held* rather than swept — reported informationally in the job output, never as a
+failure — until that PR merges or closes. If the open-PR lookup itself fails (auth,
+network, rate limit), every otherwise-sweepable fragment is held for that run rather than
+swept blind; the next push to `next` tries again. A fragment fully spent AND untouched by
+any open PR sweeps exactly as before — this changes *when* a spent fragment is removed,
+never what "spent" means.
+
 `npm run regen:derived` still exists for the artifacts that ARE committed and derived —
 `sync-manifest-versions`, the ADR index, the capability matrix, the inventory manifest,
 the registry, and `tests/fixtures/install-tree/*.json` (`npm run gen:install-tree`, the