gapfill2: worker/sub90 coverage tests, G7 rollback branch, G5 caller-contract docs

H1 worker.py 92%->94% (277->210 miss): 35 real-assertion tests
covering goal-signal, tenant/env, followup, poll/wait,
process/watchdog and injected defensive branches; prod code 0 changes.
H2 sub-90 sweep: approval_timeout 100%, merge_gate_hard 100%,
worker_sweep 98% (only __main__ line 174 left); 14 tests.
H3 G7 rollback except:pass (server.py:6615-6616) covered by an
injected rollback-raising connection; original error still propagates,
status stays completed, retry succeeds; no semantics change.
H4 caller contract documented only (docstrings in _audit_scorecard
endpoint, check_baseline_stale, build_scorecard, baseline store):
current_main_head caller-supplied, any string as-is, no format checks,
missing/empty treated as not passed with no stale determination at the
endpoint, always 200, overall never rewritten; no new validation or
rejection, no response-structure change. 3 doc tests pin the wording.
H5 design notes (no decisions, no code changes) live in
verification/code-to10-gapfill2-design-notes.md, referenced by the
batch summary.
No bug found by the new tests; no existing assertion touched.

cloud/server.py

@@ -9194,6 +9194,16 @@ pid 须为整数、address 须为字符串，否则 400（注册表里的
         参数也永远返回 200 + 报告，只是多一个判定字段。
         生产代码绝不读 git、不起 subprocess 查版本：main 头
         只能由调用方传入，端点本身不探测版本控制状态。
+        调用方契约（gapfill2 H4，只写文档、不改行为）：
+        current_main_head 由调用方提供，接受任意字符串、原样
+        使用，不做任何格式校验（不要求形如 commit hash，不
+        校验长度、字符集、前缀）；端点不验证该值是否真实、
+        是否可信、是否确为 main 头——可信 main 头的来源仍是
+        调用方责任。缺失（未传该查询参数）与空串一律按未传入
+        处理：端点不调用判定、不附加 baseline_staleness 字段，
+        响应与以前完全一致。传入非空值后，端点永远返回 200 +
+        报告、只附加判定字段：判定为 stale 也不挡查询，绝不改
+        写报告的 overall / overall_pass。
 
         权限：与 /metrics 同款，任意项目成员即可读（不要求 owner），
         但本端点不统计任何项目数据、不写库、不写账本、不改链头、