fix(bin): fail loudly for queued-unsubmitted steers

[sparkus]

Summary

Fixes #1474: fm-send no longer exits 0 when a steer stays in a numbered #N [fm-from-firstmate] composer queue (stale composer in a parked lane).

This is a fork-tested contribution of the fix that already landed as sparkus/firstmate#6, rebased cleanly onto upstream main.

What changed

• After each Enter that would report delivery, scan for a numbered #N [fm-from-firstmate] queue item.
• Retry Enter only within the existing budget; if the item remains, report queued-unsubmitted so fm-send exits non-zero.
• Tri-state queue probe (queued | clear | unknown):
  • queued → do not claim delivery; exhaust as queued-unsubmitted (non-zero).
  • clear → delivery proof stands (including clear on exhaustion rescan → empty).
  • unknown (unreadable pane) → never report delivered (non-zero / unconfirmed).
• Preserve the opencode busy-queue exception on the tmux path.
• Tests for all four outcomes: queued exhaustion, retry success, unreadable probe, exhaustion-rescan clear.

Scope (honest)

Covered and exercised on our fork: the tmux (verified reference) and Herdr (live fleet) submit paths only.

Untouched: other backends, including Zellij, keep their existing behavior. We did not add a Zellij queue probe, and we have not tested this change on Zellij. Extending the same tri-state probe to Zellij (or a shared submit boundary) is a natural maintainer follow-up if desired - better a narrower fix that is honestly proven than a wider one that is partly speculative.

Accuracy in both directions

• Fail loud when a numbered firstmate queue item still sits after the Enter budget (false "delivered" fixed).
• Still report success when the queue clears, including on the final exhaustion rescan (no false failure on late clear).
• Unreadable verification never reports delivered.

Testing

Focused local runs: tests/fm-composer-lib.test.sh, tests/fm-tmux-submit-busy.test.sh, tests/fm-send-strict.test.sh, tests/fm-backend-herdr.test.sh, plus a deterministic full-CLI harness for all four outcomes.

Risk note

A pipeline review finding asked to expand the probe to Zellij/shared submit. That was deliberately not done for this PR: the accepted deliverable is the fork-proven tmux+Herdr fix for #1474, not untested broader coverage.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 error (approved as intentional scope)

• Zellij/shared-boundary expansion finding was reviewed and approved as-is: deliverable is the fork-tested tmux+Herdr fix only; Zellij remains out of scope and untested.

✅ **Test** - passed

✅ Focused composer, tmux, fm-send, and Herdr tests passed; full-CLI evidence for all four required outcomes.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.