Build the auto-commit engine

Every settled change on a git-mode board commits, debounced 2s past
drag/typing churn, staged whole-root with .gitignore respected.
GitCommitOperation reaches the vendored libgit2 directly (same 1.9.2
pin SwiftGitX resolves — importable, not duplicated) for
signature-capable commits; add-git's config materialization is gone,
identity resolves at commit time (repo-local config, else derived
default) per the 2026-07-31 ruling in 06. CommitAttribution
classifies per file off EchoLedger receipts: user identity on
app-mediated windows, Lanework External <[email protected]>
on foreign, the modified-by refinement (<slug>@agents.lanework
.invalid) when every foreign file agrees, heal-marked receipts split
into their own commit — window split foreign → heal → user.
Edit-session granularity: ~700ms saves stay uncommitted, staging
excludes open session folders (closure-resolved so mid-session moves
stage around the new location), session end nudges the debounce so
each session lands exactly one body commit. Flush-before-overwrite
gates on known-foreign windows and commits synchronously ahead of
the write; close/quit flush the pipeline via CloseFlushCoordinator's
committerFlush. index.lock backs off briefly then re-debounces
silently; clean tree no-ops; genuine failures ride the standing
history-suspension banner and retry next debounce. Abnormal repo
states (detached HEAD, merge/rebase/cherry-pick in progress) hold
the engine with a 15s re-check; unborn HEAD commits "Initial board
state" whole-tree; dirty tree at open catches up through the same
engine. Message seam (CommitMessageComposing) ships interim — the
semantic composer is the next card.

Discovery diffs HEAD against an in-memory index with rename
detection (git status alone never pairs a bare mv), and a failed
survey reads as "could not look", never "nothing changed".

46 new tests / 8 suites, all real repositories via bundled libgit2.
2240 tests / 383 suites green; InertGitTests untouched.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/UI/Card/CardBodyMode.swift

@@ -71,6 +71,15 @@ public final class CardBodyPresentation {
     /// than by three call sites remembering.
     public var flushEdits: (() -> Void)?
 
+    /// **Opens an Edit session** — the mirror of `flushEdits`, and here for its reason exactly: this
+    /// is the type every path that *enters* Edit already holds, so attaching the announcement to the
+    /// flip makes "always" true by construction rather than by three call sites remembering.
+    ///
+    /// Filled in by the window with its edit session's `beginEditSession()`. Its consumer is pro-m1's
+    /// auto-committer, which stages around the card's folder for as long as the session stands
+    /// (06-history-undo.md ▸ Rules ▸ Auto-commit).
+    public var beginEdits: (() -> Void)?
+
     /// Whether the opening rule has already run for this window.
     ///
     /// **Once, not per snapshot.** The rule is about *opening* a card, and the body it judges
@@ -87,6 +96,9 @@ public final class CardBodyPresentation {
         guard !hasOpened else { return mode }
         hasOpened = true
         mode = CardBodyMode.opening(body: body)
+        // A card that opened straight into Edit because its body was empty is in a session exactly
+        // like one the user pressed ⌘E in, and the committer has to stage around it either way.
+        if mode == .edit { beginEdits?() }
         return mode
     }
 
@@ -111,6 +123,7 @@ public final class CardBodyPresentation {
         guard newMode != mode else { return }
         if mode == .edit { flushEdits?() }
         mode = newMode
+        if newMode == .edit { beginEdits?() }
     }
 }