feat(sweep): fan out self-repair across terminal instances (#1152)

[fujibee]

Adds the explicit, team-scoped leader sweep command for #1152. It consumes the shared terminal census as (kind, instance, pane) triples, keeps process classification outside the census, requires roster/label/process agreement, composes the target and fix --pane argument once from the same row, and routes every write through one fenced poke boundary.

The command is intentionally explicit-only and fail-closed: census holes, malformed observations, unknown occupants, instance refusals, locator refusals, label mismatches, and fence failures are loud and produce no write. Plain emulator locations use the same loop and fence boundary as herdr and tmux.

The shared census and locator composer are connected. The instance-aware label/process/write-fence production adapters remain rc 127 until #1157 supplies their ABI; tests replace only those internal seams and pin zero-write behavior. This PR remains draft until that final wiring lands.

Tests: bats tests/test_sweep.bats; bats tests/test_sweep_enumeration.bats; bats tests/test_enforced_assertions.bats; bash -n scripts/lib/sweep.sh; git diff --check.

[fujibee]

Closing as superseded by the measured seat-side design for #1152. A repair command must not accept or derive a pane supplied by an external coordinator: the seat establishes its own location through proof, writes only when that proof succeeds, and otherwise remains undetermined. The process/label/instance arbitration and fix --pane <ref> transport in this PR therefore encode the wrong authority boundary rather than reusable scaffolding. The replacement is the argument-free seat-side fix path in #1157, with the emit-and-observe fallback tracked by #1188. Fleet fan-out only needs to ask each reachable member to run that command; it does not need a second repair command or a locator-carrying protocol.