factory_worktree.py: create (git worktree add rune-wave-<hash>),
enter, land (merge inside throwaway rune-merge worktree, run
unified_check.py + check_landing.py against the MERGED tree, green =
CLEARED TO LAND), cleanup. No subcommand writes files or moves refs
in the main tree (update-ref ref-surgery rejected — phantom-dirty +
silent no-op, probe-proven). 8 frozen tests red-first. Landing gate
catches breakage at merge: unbuildable Go module, RED manifest,
missing manifest. Main-session verify: own runs green.
