Add a high-level linearizable run submission command for repository worktrees

[douglasjarquin]

Problem

The public made run submit interface still requires low-level gate/ref/SHA inputs and does not own the complete user-facing operation. A consumer such as Consigliere should not have to coordinate an ambiguous sequence of resolving the gate, pushing a ref, recovering a run ID, and guessing whether durable submission succeeded.

Required implementation

Add a high-level command:

made run submit --json --repo <task-worktree>

The command must:

1. Resolve and canonicalize the repository/worktree path.
2. Resolve the associated Made gate and verify it is managed by the current MADE_HOME.
3. Resolve the exact current branch and HEAD SHA.
4. Reject detached HEAD or unsupported identity unless explicitly supported and documented.
5. Resolve the previous gate-ref SHA or zero SHA safely.
6. Reserve or recover one durable submission identity keyed by gate/ref/input SHA.
7. Push the exact commit/ref through the Made gate.
8. Ensure the durable submission record exists before reporting success.
9. Wait boundedly for the exact run record to become queryable.
10. Return structured data including:
    • run ID
    • repository ID
    • branch
    • input SHA
    • protocol version
    • status-schema version
    • config-schema version
    • state
11. Repeating the command for the same gate/ref/SHA must return the same run ID.
12. If Push succeeded but response delivery or run materialization was interrupted, return an explicit recoverable partial-submission result and support idempotent recovery.
13. The consumer must never invent its own run ID.
14. Keep lower-level gate/ref/SHA interfaces internal or clearly marked as advanced hook/testing surfaces.
15. Do not alter Made’s merge authority boundary.

Acceptance criteria

• One command gives Consigliere an exact durable run ID.
• Successful response always corresponds to queryable durable run state.
• Same submission is idempotent across retries, process failures, and daemon restarts.
• A daemon interruption cannot create two runs for one gate/ref/SHA identity.
• Branch and input SHA in the response exactly match the submitted worktree.
• Unsafe/detached repository identity fails clearly.
• Partial submission is recoverable without scanning run history.

Required tests

• normal worktree submission
• same-submission retry
• push succeeds, client response is lost
• daemon restarts during submission
• concurrent duplicate submissions
• detached HEAD rejection
• wrong/unmanaged gate rejection
• branch changes during submission
• gate ref already at the same SHA
• exact response-schema validation
• no consumer-supplied run ID required