fix(protocol): a failing semantic resolver must not publish conflict markers (closes #94)

[psaboia]

Closes #94. Field-reported on naval-sensor-fusion: a real multi-writer collision where the reporter's resolver callback "correctly reported failure, and the wrapper committed anyway" — raw <<<<<<< markers pushed to the shared wiki.

Root cause

wiki_push's semantic branch ignored resolve_fn's exit status and never checked for leftover markers — unconditional add + commit + push-retry. The documented production resolver (llm_resolve() { return 1; }, "defer to agent turn") was precisely the trigger, so the canonical path published markers on every real semantic collision. None of the 9 CI scenarios used a failing resolver, so the path had never been red.

Fix

Resolver non-zero, or markers remaining after a claimed success, marks the file unresolved. After the conflict loop: the merge is left in its conflicted state (exactly what wiki-write-protocol.md promises), unresolved files are listed with recovery instructions, and wiki_push returns new code 4 — nothing committed, nothing pushed. Union-merged index/log files stay staged so the agent's resolution commit completes the whole merge. Headers + protocol doc name exit 4.

Evidence

New scenario 10 reproduces the field anatomy (collaborator lands a new page + index/log entries + an OSPA-Metric.md edit; reporter holds different index/log entries + a same-paragraph edit; resolver = documented llm_resolve):

• Red (unfixed): 4 failures — returned 0, wrapper printed semantic-resolved for a failed resolve, markers reached origin, worktree not left conflicted. Faithful to the field report line by line.
• Green (fixed): PASS — exit 4, origin marker-free, worktree conflicted with instructions printed, and the recovery leg (hand-resolve keeping both sides, commit, re-run wiki_push) converges with unions intact — the reporter's manual fix, now as the designed flow.
• Stash contrast brings the 4 failures back. All 10 scenarios green; full harness 1168 / 0 / 0.

Scenario 10 added to TEMPLATE_SHARED_INFRA (the #84-era lesson), so derived repos receive it on sync.