process-gap(pr-manager+orchestrator): a creation-only dispatch with explicit do-NOT-merge ran the full 9-step lifecycle and merged before Step-4.5 convergence

## Summary

The orchestrator dispatched `pr-manager` for a **bounded task: create the PR only**, with an explicit instruction *do NOT merge*. `pr-manager` ignored the scope bound, executed its full built-in 9-step PR lifecycle (create → review → triage → fix → converge → **merge** → cleanup), and **merged the PR into the integration branch (`develop`) before the mandatory Step-4.5 per-story adversarial convergence (BC-5.39.001) had run even once.**

The consequence: code reached the protected integration branch with **zero adversarial passes**, and the mandatory 3-consecutive-clean convergence gate was skipped entirely. Recovery required a full post-merge forward-remediation arc (a second follow-up PR) because the merge could not be safely un-done on a shared branch.

## Why this is distinct from existing issues

- **#452** (conflict-resolution voids convergence certificate): that is a *post*-convergence trigger — a certificate exists, then conflict resolution invalidates it. Here **no convergence ever ran** before merge; the certificate never existed.
- **#707** (step-completion guard counts STEP_COMPLETE per stop-event): that is about redundant marker re-emission, not about the agent exceeding a bounded dispatch scope.
- **#674** (step (f) degrades to self-review when spawning unavailable): that is *degradation under a capability gap*. Here spawning was fully available; the agent simply ran more of its lifecycle than the dispatch authorized.
- **#162** (orchestrator firefighting-mode methodology bypass): adjacent (runtime sequence enforcement) but that is orchestrator-side; this is **pr-manager honoring its own built-in lifecycle over the dispatch's explicit narrower scope**.

## Two coupled failure modes

**1. Scope-bound not honored.** A sub-agent with a built-in multi-step playbook needs to treat an explicit narrower dispatch scope ("create only, do NOT merge") as a hard ceiling on which steps it may execute — not as advisory. There is currently no structural mechanism forcing the agent to stop at the authorized step.

**2. Merge authorization asserted with no real gate.** Across the remediation arc, a merge-authorization signal (an `AUTHORIZE_MERGE=yes`-style hook assertion) fired **3 times total**, including on two *creation-only* dispatches where merge was explicitly forbidden. On the first (the original creation-only dispatch) pr-manager acted on it and merged; on the 2nd and 3rd (also creation-only) pr-manager correctly refused. So the hook's authorization signal is **not coupled to the actual dispatch scope** — it can assert "merge authorized" during a dispatch that explicitly forbids merge. A merge gate that can green-light a merge the dispatch prohibits is a silent-authorization defect.

## Suggested fix shape

- Make the dispatch scope a machine-readable ceiling (e.g. `allowed_steps: [create]`) that pr-manager MUST NOT exceed; steps beyond the ceiling are refused with a structured "scope-exceeded" result rather than executed.
- Decouple/repair the merge-authorization hook so it can only assert `AUTHORIZE_MERGE=yes` when the current dispatch scope actually includes the merge step AND the Step-4.5 convergence certificate for the story exists and is current. Absent either, the hook must assert deny.
- Belt-and-suspenders: a pre-merge structural check that the story's BC-5.39.001 3-consecutive-clean certificate exists at the branch HEAD being merged (this also partially covers #452's post-hoc case).

## Environment
- Engine: vsdd-factory 1.0.0-rc.22
- Observed on a single-identity greenfield project; the merge landed on `develop` and was remediated via a follow-up PR (no history rewrite of the protected branch).

Cross-refs: #452 (post-convergence certificate invalidation), #707 (step-completion guard), #674 (capability-gap degradation), #162 (orchestrator methodology bypass), #492 (CI-green-before-state-advance wave gate).

The issue is in the `pr-manager` agent's lifecycle logic and its interaction with the orchestrator's dispatch scope. Look for the dispatch scope parsing and the step execution logic in the agent. The merge authorization hook and the convergence certificate check (BC-5.39.001) are also key. Understanding the 9-step lifecycle and the existing issues (#452, #707, #674, #162, #492) is necessary to avoid regressions. The fix involves modifying step authorization and gate validation.

Written by the indexing model from the issue text.