Standing authorisation to push fixes without asking was already in place; what
was missing were the checks that make it safe to exercise.

Both failed today. The session-start git snapshot said `main` while a parallel
session had since checked out a feature branch in the same working copy, so a
verified fix was committed to the wrong branch — and `git push origin main`
then reported "Everything up-to-date" and exited 0 while the fix sat elsewhere.
A no-op push is indistinguishable from a successful one unless the remote ref
is checked.

Also makes explicit-path commits mandatory. This checkout is shared with other
sessions whose in-flight work can be staged in the index; `-a` or `git add -A`
would sweep it into a fix commit and deploy it to every tenant.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>