Pin backend and core gitlinks and record follow-up hardening

Why: two strands land together — (1) the remaining 20 module-level govulncheck advisories against x/crypto v0.37.0 clear to the upstream floor via Backend#25 (19 fixed, GO-2026-5932 unfixed upstream); (2) backend main (daddac8) and core main (cafd9a5) from the parallel cardflow merge were not yet pinned, and backend main no longer built against the Dev-pinned core — pinning the coherent pair keeps main verifiable.
Evidence: combined make test exit 0 at backend daddac8 + core cafd9a5 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend go test green and govulncheck 0 affected / 0 import-level / 1 module-level; task.sh hardening smoke-verified (drift measurement, identity probe, abandon cleanup all PASS).
Impact: two gitlink pins + task card; no Dev-repo source change; remote branch hygiene (55 merged branches deleted) and global git identity were environment fixes outside the repo.
Refs: .task/fix-followup-hardening.md, Backend PR #25

.task/fix-followup-hardening.md

@@ -6,7 +6,13 @@
 
 - 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 48c3da846f801c53164b93a9c79affb98689f791
 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-followup-hardening（worktree）；分支：fix/followup-hardening
-- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 授权与交付终点：修复过程遗留小坑（全局 git 身份、远端已合入分支残留、task-start 物化静默失败、close push 无重试）并将 backend 剩余 20 条 module 级依赖通告清至地板；终点为 backend PR 与 Dev PR 合入后回收 worktree。
+
+## 目标与非目标
+
+- 目标：①设全局 git 身份（修新克隆提交失败）；②清理远端已合入分支；③task.sh start 物化后按 submodule status 实测核对（不只信退出码）+ close push 失败重试一次；④backend x/crypto→v0.56.0 清 19 条 module 级通告；⑤Dev 钉 backend daddac8 + core cafd9a5（并行会话已合入未钉的配套对，随本卡一并收敛）。
+- 非目标：不动 GO-2026-5932（上游无修复版，地板）；不处理 frontend/ui（audit 已清零）；不重写 precheck 判脏口径。
+- <本次允许的动作与终点；未授权事项写明>
 
 ## 目标与非目标
 
@@ -23,3 +29,9 @@
 - 结果：
 - 验证：
 - 影响与剩余项：
+
+## 结果与验证
+
+- 结果：全局身份已设（weichen <weichen@home.local>）；远端 55 条已合入分支全删（剩 main + 活跃 cardflow-r1）；task.sh 两处小修提交 aeb9a6a；backend PR #25（5a01b0e）合入，backend main=daddac8；Dev 双 gitlink 钉入。
+- 验证：冒烟——throwaway 任务 start（嵌套物化漂移实测计数）+ 新克隆空提交探测（身份生效）+ FORCE_ABANDON finish 干净回收，全部 PASS；backend go build/go test 绿且 govulncheck 报 0 affected / 0 import / 1 module（GO-2026-5932 上游无修复）；Dev make test exit 0（backend 全包 ok、frontend 33/33、ui 37/37、agentcmd ok）。
+- 影响与剩余项：无阻断项；GO-2026-5932 待上游发修复版后随 routine bump 消化；close push 重试的真实链路验证随本卡收尾的卡片自动闭合完成。