blaze-host: move the dirty-tree safeguard to launch and evidence time

The compiled-in dirty flag cannot be trusted for this job. Cargo does not
re-run a build script when another crate's source changes, so editing the
adapter and rebuilding the host leaves it reading 'clean' -- verified by
appending a line to the adapter and watching the flag not move.

So the stamp now only names the commit, and the real safeguards run at the
moment they matter and cannot go stale:

  * sidecar.sh checks the working tree at LAUNCH and warns.
  * check-live-parity.sh REFUSES on a dirty tree, since it produces the
    artefact a migration decision is made from. ALLOW_DIRTY=1 overrides for a
    throwaway check.

Both scope to the three migration crates, so unrelated submodule dirt does not
trigger them -- a warning that is always on is a warning nobody reads.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

openfut-blaze-host/check-live-parity.sh

@@ -38,6 +38,23 @@ if [[ ! -x "$PROBE" ]]; then
   exit 2
 fi
 
+# This script produces the artefact a migration decision is made from, so it
+# refuses to run against a tree that does not correspond to a commit. The
+# compiled-in build stamp cannot be trusted for this (cargo will not re-run
+# build.rs for another crate's edit), so the check happens here, now.
+if git rev-parse --git-dir >/dev/null 2>&1; then
+  DIRT="$(git status --porcelain --untracked-files=no -- \
+            openfut-blaze-host openfut-adapter-fifa17 openfut-protocol-blaze 2>/dev/null)"
+  if [[ -n "$DIRT" && "${ALLOW_DIRTY:-}" != "1" ]]; then
+    echo "REFUSING: migration crates have uncommitted changes:" >&2
+    echo "$DIRT" | sed 's/^/  /' >&2
+    echo >&2
+    echo "A parity result from an unidentifiable build is not evidence." >&2
+    echo "Commit first, or re-run with ALLOW_DIRTY=1 for a throwaway check." >&2
+    exit 2
+  fi
+fi
+
 mkdir -p "$OUT"
 fail=0
 frames=0