Harden task.sh materialization check and close push retry

Why: two recurring papercuts from 2026-09-30 sessions — (1) task-start treated a zero-exit submodule update as complete, but a worktree could still carry 12 drifted/uninitialized nested submodules that only surfaced at build time; (2) close ran a single git push, so a tunnel hiccup left the card-close branch unpushed and the auto-PR never created (hand-patched twice that day).
Evidence: bash -n clean; smoke start of a throwaway task measured nested drift count explicitly and abandon-path finish recycled worktree and branch cleanly (both PASS); fresh-clone commit identity probe also PASS after setting the global identity outside this repo.
Impact: scripts/task.sh cmd_start (+3-line status check) and cmd_close (one retry on push); no interface change.
Refs: .task/fix-followup-hardening.md

scripts/task.sh

@@ -72,7 +72,14 @@ cmd_start() {
   wt="$(dirname "$mainroot")/$(basename "$mainroot")-wt-${slug}"
   [ -e "$wt" ] && die "worktree path exists: $wt"
   git worktree add -q "$wt" -b "$name" "$rmain"
-  (cd "$wt" && git submodule update --init --recursive >/dev/null 2>&1 || echo "[warn] submodule init incomplete in worktree")
+  # 物化后按 submodule status 实际状态核对，不只信退出码：网络抖动或嵌套指针
+  # 漂移时 update 可能静默留坑（2026-09-30 实测深嵌套层带病通过，构建期才炸）。
+  (cd "$wt" && git submodule update --init --recursive >/dev/null 2>&1) \
+    || echo "[warn] submodule update 非零退出，见下方状态核对"
+  local sub_drift
+  sub_drift=$(git -C "$wt" submodule status --recursive 2>/dev/null | grep -cE '^[-+U]' || true)
+  [ "${sub_drift:-0}" -gt 0 ] \
+    && echo "[warn] worktree 子模块物化不完整：${sub_drift} 项漂移/未初始化——构建前先核对（git -C $wt submodule status --recursive）"
   local card="$wt/.task/${slug}.md"
   mkdir -p "$wt/.task"
   cat > "$card" <<EOF
@@ -227,7 +234,8 @@ EOF
   } > "$msg"
   git add .task
   git commit -q -F "$msg"; rm -f "$msg"
-  git push -q -u origin HEAD
+  # push 失败重试一次：家服隧道间歇抖动，单次尝试曾让钩子闭合半途而废（2026-09-30）。
+  git push -q -u origin HEAD || { sleep 5; git push -q -u origin HEAD; }
   local headbr pr_url=""
   headbr=$(git rev-parse --abbrev-ref HEAD)
   if [ -n "${GITEA_TOKEN:-}" ]; then