fix(spawn): poll for a genuine isolated worktree, not just a differing path

[edugomz]

Summary

• The post-treehouse get worktree-detection loop in bin/fm-spawn.sh accepted the first pane path that merely differed from the project directory.
• A brand-new tmux pane can transiently report an unrelated pre-shell-init cwd before it ever reaches the project directory; that transient also differs from the project path and was wrongly latched onto, tripping the isolation guard against a path that was never the real worktree.
• Reproduced with plain tmux commands independent of any firstmate code (a fresh pane briefly reports the multiplexer's default directory for ~0.2-0.4s before settling), so this is a general timing race, not environment-specific.
• Fix: poll until the reported path itself resolves to a genuine, isolated git worktree (spawn_worktree_ok, a predicate shared with the existing fatal validate_spawn_worktree check), instead of accepting the first path that merely differs from the project directory.

Test plan

• New regression test tests/fm-spawn-worktree-race.test.sh using a fake tmux that scripts the exact transient-then-project-then-worktree sequence; fails against the pre-fix code, passes against the fix.
• Full existing spawn/backend/tangle-guard test suites pass (fm-spawn-batch, fm-spawn-dispatch-profile, fm-tangle-guard, fm-backend*).
• shellcheck -x bin/fm-spawn.sh clean.