release: 0.19.0 — the ticket state machine gets its shared law

[naashw]

Lot 1: a state requires its proof

Stabilizes the ticket state machine end to end, per docs/recovery.md (rung 0: prevention by construction).

• Shared transition table in @codesema/contract (ticket-state.ts): TICKET_TRANSITIONS, isLegalTicketTransition, derived terminal statuses, targetTicketStatus. The runner refuses to report a transition the table forbids from the last hub-answered status (new task-record field hub_ticket_status); the hub validates the same table on its side (shipped separately).
• Proof fields required: ArmTransition is a discriminated union; mr_opened requires mr_url, merged requires merge_sha (compile time, sanitizer, JSON schema). Fixes the 2026-08-28 phantom mr_opened incident: a ship whose gh pr create failed was still reported as mr_opened and the hub drafted a ticket on it.
• merge_sha capture: after a landed merge the runner reads the merge commit back (gh pr list --json number,mergeCommit / glab merge_commit_sha); unreadable proof skips the report (journaled merged_sha_unknown, the hub forge webhook reconciles).
• Merge settings re-read live at merge time (getChecksConfig pattern): a mergeStrategy set through the settings API no longer waits for a restart.
• Auto-merge without a strategy refused before the forge, reason merge_strategy_unconfigured, message carries the way out. Manual-path D13 behavior untouched.

Versions: codesema 0.19.0, @codesema/contract 0.10.0. Full suite: 5592 tests, typecheck, lint green.

🤖 Generated with Claude Code