Merge #474 follow-up: pin main's ConfigRef wiring against the surviving mutation

My battery on the #474 merge found one survivor: reverting Fleetd.java:154
from the three-argument ConfigRef constructor to the plain two-argument
one turns the live reload gate off and leaves all 1633 tests green. Both
new #474 tests build their own ConfigRef with the method reference, so
neither reads what main chose.

This adds FleetdConfigRefWiringTest, following the three source-text
precedents already in the tree (FleetdBackendQuarantineWiringTest,
FleetdLeadSeatWiringTest, FleetdCompletionResolverWiringTest) rather
than the weaker sibling pattern that builds the wiring itself. No
production change.

The worker branched fresh off 4466ee0 rather than continuing its old
branch off the stranded 435e022 base. That was its own call and it was
the right one: one merge base, a clean 80-line diff, and no cherry-pick
needed this time.

Its vacuity guard is worth keeping in mind for the next source-text
test: it asserts the file it read contains 'public final class Fleetd'
before asserting anything about the mutation, with a message saying the
assertFalse below would pass vacuously on a broken read. An unrelated
anchor is the right choice there, because a guard that shares the
mutation's text cannot tell a bad read from a real change.

fleetd/src/test/java/dev/ltms/fleet/FleetdConfigRefWiringTest.java

@@ -0,0 +1,80 @@
+package dev.ltms.fleet;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #474 follow-up: {@code Fleetd.main} builds its live {@code ConfigRef} from the
+ * three-argument constructor, {@code new ConfigRef(configPath, cfg,
+ * Fleetd::assertChartersNameOnlyRegisteredTools)}, so a reload runs the same charter tool-surface
+ * gate startup does (see {@link dev.ltms.fleet.config.ConfigRef}'s class doc, "fleetd #474" bullet).
+ * {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} prove the
+ * three-argument constructor and the {@code Fleetd.assertChartersNameOnlyRegisteredTools} adapter
+ * work correctly together — both build their OWN {@code ConfigRef} with that constructor, so neither
+ * proves {@code main} still CHOOSES the three-argument form over the plain two-argument {@code new
+ * ConfigRef(configPath, cfg)}.
+ *
+ * <p>Measured directly: reverting {@code Fleetd.java}'s {@code config} local to the two-argument
+ * constructor compiles with 0 errors and leaves the entire 1633-test suite green — including every
+ * {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} case — because
+ * neither of those tests constructs its {@code ConfigRef} through {@code main}; both build their own
+ * instance directly, wired with the check by hand. That silent regression is exactly the shape
+ * {@link FleetdBackendQuarantineWiringTest}, {@link FleetdLeadSeatWiringTest} and {@link
+ * FleetdCompletionResolverWiringTest} already guard against for their own constructor arguments —
+ * this class is the same class of gap for fleetd #474's {@code extraValidation} argument, following
+ * their approach.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * ConfigRef} and never runs {@code main} — a green result here proves only that the exact text
+ * {@code main} contains is the three-argument construction with {@code
+ * Fleetd::assertChartersNameOnlyRegisteredTools}. It does not prove that call actually executes at
+ * startup (no test here starts the daemon), and it does not prove the reload gate itself works —
+ * only {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} prove the
+ * behaviour; only a live daemon proves the wiring runs.
+ */
+class FleetdConfigRefWiringTest {
+
+    private static String fleetdSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] main still builds config from the three-argument ConfigRef constructor")
+    void mainStillWiresTheThreeArgumentConfigRefConstructor() throws Exception {
+        String source = fleetdSource();
+
+        // A broken read (wrong working directory, wrong path, a file that came back empty) would
+        // make the assertFalse below pass vacuously — a "clean" negative check that actually
+        // checked nothing. Guard against that first, with an anchor that has nothing to do with
+        // this mutation, so a bad read fails loudly here instead of silently proving nothing below.
+        assertTrue(source.contains("public final class Fleetd"),
+                "fleetdSource() did not read anything usable — src/main/java/dev/ltms/fleet/Fleetd.java "
+                        + "did not come back containing its own class declaration. The assertFalse below "
+                        + "would pass vacuously on a broken read; fix the read before trusting this test.");
+
+        assertTrue(source.contains(
+                        "ConfigRef config = new ConfigRef(configPath, cfg, "
+                                + "Fleetd::assertChartersNameOnlyRegisteredTools);"),
+                "Fleetd.main's config local must still be built from the three-argument ConfigRef "
+                        + "constructor, with Fleetd::assertChartersNameOnlyRegisteredTools as "
+                        + "extraValidation. Reverting to the plain two-argument constructor (fleetd #474's "
+                        + "measured M2 regression) compiles with 0 errors and leaves the whole suite green — "
+                        + "including ConfigRefTest and FleetdConfigRefCharterToolSurfaceWiringTest, because "
+                        + "neither builds its ConfigRef through main — this source check is what must go "
+                        + "red instead. A reverted daemon would accept, through a reload with no restart, "
+                        + "exactly the charter that #469/#474 already refuse at startup.");
+
+        // Negative form of the same check: the pre-#474 two-argument call, if it ever reappears at
+        // this declaration, must not be mistaken for the three-argument one by a looser
+        // positive-only check — this is the M2 mutation this test exists to kill.
+        assertFalse(source.contains("ConfigRef config = new ConfigRef(configPath, cfg);"),
+                "main's config local must never regress to the plain two-argument ConfigRef "
+                        + "constructor — that drops the reload-path charter check (fleetd #474's measured "
+                        + "M2 mutation) with no other test catching it");
+    }
+}