fix(merge-guard): bind privileged flags (--admin/-R/--no-verify) to the approval (#1042)

[michael-wojcik]

Summary

Closes a SACROSANCT merge-guard bypass: privileged flags (--admin, -R/--repo, --no-verify) rode past the (operation, target) authorization binding because the shared command-context extractor dropped all dash-flags. An approved force-merge and the same command executed with --admin bound identically — so a branch-protection-bypassing flag executed undetected. Same binding-integrity class as #1031/#1032.

What landed

• C1 (merge_guard_common.py): PRIVILEGED_FLAGS op-class-scoped denylist + a linear extract_privileged_flags scanner, surfaced as a bound_flags dimension computed once in the shared SSOT — both hook arms inherit it (un-driftable). bound_flags is a pair attribute, never part of pair identity.
• C2 (merge_guard_pre.py): a never-escalate set-equality gate on bound_flags in the read path — any added privilege OR dropped constraint refuses, unconditionally.
• C3 (merge_guard_post.py): the mint widened to scan the full selected-option surface (flag after a quoted argument not lost; read/mint symmetry).
• Peer-review addition: --match-head-commit bound (value-taking) — closes the dropped-constraint direction (approve carrying a head-SHA pin, execute without it → refuse).
• Tests: a RED bypass matrix with measured per-mechanism non-vacuity, A1 mint-seam coverage via the real write_token → check_merge_authorization path, scanner-linearity witness, -R=value/--match-head-commit form coverage, and a -- end-of-options over-block witness.

The fix decomposes "privileged flag" into three effect-classes — privilege (--admin), target-identity (-R/--repo), side-effect (--delete-branch) — bound by one set-equality mechanism. Combined-short clusters (-dR owner/repo) and the git-only unambiguous-prefix abbreviation under-block (--no-verif → --no-verify) are handled; op-trigger flags already bound via op_type are excluded.

Verification

• Full suite: 9771 passed, 15 skipped, 0 errors (py3.13.7; errors-count explicitly scanned, not the rtk-masked summary).
• Non-vacuity (counter-test-by-revert, measured): C2 gate revert → 25 read-arm REFUSE RED; C3 mint revert → 1 RED; is_git_surface=False mutation → 9 abbreviation RED / 11 exact GREEN; --match-head-commit revert → 5 RED (scanner-derived token, provably coupled).
• No-touch surface (pair identity / #797 lifecycle / SEAM / hooks.json) verified UNCHANGED against git diff.

Peer review

Unanimous PASS — 0 Blocking across an independent four-arm review (CODE-phase auditor + architect design-fidelity + test-engineer coverage-matrix + security-engineer adversarial, the last under an independence guard). The one residual under-block found — the dropped-constraint --match-head-commit case — was closed in-cycle (commits above), then verify-only re-reviewed GREEN. One Future item remains: shell-quote obfuscation of the command token, a pre-existing boundary of the guard's literal-string threat model (op-token obfuscation already bypasses the whole guard), accepted by design — not a #1042 regression.

Bumps plugin 4.4.43 → 4.4.44 (PATCH — security hardening). Completes the acceptance criteria of #1042; closure pending a post-install live-probe of the installed v4.4.44 merge_guard (runtime-hook gate, per the #1031/#1032 precedent).