blaze-host: move the dirty-tree safeguard to launch and evidence time

The compiled-in dirty flag cannot be trusted for this job. Cargo does not
re-run a build script when another crate's source changes, so editing the
adapter and rebuilding the host leaves it reading 'clean' -- verified by
appending a line to the adapter and watching the flag not move.

So the stamp now only names the commit, and the real safeguards run at the
moment they matter and cannot go stale:

  * sidecar.sh checks the working tree at LAUNCH and warns.
  * check-live-parity.sh REFUSES on a dirty tree, since it produces the
    artefact a migration decision is made from. ALLOW_DIRTY=1 overrides for a
    throwaway check.

Both scope to the three migration crates, so unrelated submodule dirt does not
trigger them -- a warning that is always on is a warning nobody reads.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

openfut-blaze-host/sidecar.sh

@@ -32,6 +32,22 @@ BIN="$ROOT/target/debug/openfut-blaze-host"
 
 die() { echo "sidecar: $*" >&2; exit 1; }
 
+# Authoritative working-tree check, run at LAUNCH.
+#
+# The commit stamped into the binary by build.rs can be stale — cargo does not
+# re-run a build script when another crate's source changes — so the compiled-in
+# "dirty" flag is not a safeguard. This is. It runs now, against the tree as it
+# is now, over exactly the crates the binary is built from.
+#
+# Echoes "DIRTY" or "clean" (or "unknown" outside a git tree).
+tree_state() {
+  git -C "$ROOT" rev-parse --git-dir >/dev/null 2>&1 || { echo unknown; return; }
+  local out
+  out="$(git -C "$ROOT" status --porcelain --untracked-files=no -- \
+           openfut-blaze-host openfut-adapter-fifa17 openfut-protocol-blaze 2>/dev/null)"
+  [[ -n "$out" ]] && echo DIRTY || echo clean
+}
+
 port_listening() {
   local port="$1"
   if command -v ss >/dev/null 2>&1; then
@@ -100,6 +116,13 @@ cmd_start() {
     die "port $OPENFUT_BLAZE_HOST_PORT is already in use"
   fi
 
+  local tree
+  tree="$(tree_state)"
+  if [[ "$tree" == "DIRTY" ]]; then
+    echo "WARNING: migration crates have uncommitted changes — this binary may not" >&2
+    echo "         match any commit. Do not treat its output as parity evidence." >&2
+  fi
+
   mkdir -p "$RUNDIR"
   echo "$OPENFUT_BLAZE_HOST_PORT" > "$PORTFILE"