fix(dev-lead): git identity not configured + commit failure silently swallowed + missing WebFetch tool access

[don-petry]

Problem

Two critical bugs combine to silently lose the agent's work without any error surfacing, plus one enhancement gap that limits the agent's ability to resolve issues.

Bug 1 — No git identity configured (critical)

The workflow never configures git config user.email / user.name. When commit_and_push in scripts/dev-lead-fix-reviews.sh calls git commit, git rejects it:

fatal: empty ident name (for <runner@...>) not allowed

Bug 2 — git commit failure silently swallowed (critical)

commit_and_push is called as the condition of an if statement:

if commit_and_push "human"; then
    post_reviews_terminal "human" "applied" "Changes committed and pushed."

In bash with set -euo pipefail, set -e is suspended for the entire function body when the function is the condition of an if. So git commit fails, execution continues to git push (exits 0 with "Everything up-to-date"), the function returns 0, and the PR gets a false "Changes committed and pushed" comment. The agent's fixes are silently lost.

Evidence: Run https://github.com/petry-projects/.github-private/actions/runs/26071797185/job/76654578361 — the agent made NOSONAR and trailing-newline fixes, the log shows the git identity error and "Everything up-to-date", but no commit appears on PR #80 for that session.

Bug 3 — WebFetch not in run_writer allowed tools (enhancement)

engine.sh's run_writer uses --allowed-tools "Bash,Read,Write,Edit,Grep,Glob" — no WebFetch. When the agent needed to verify a SHA256 hash from GitHub releases, it could not and noted: "This could not be safely fixed without internet access to verify the correct hash." Adding WebFetch allows the agent to look up release hashes, SonarCloud rule docs, etc.

Root cause timeline (run 26071797185)

1. Agent ran for ~6 minutes, made file edits (NOSONAR suppressions, trailing newlines)
2. commit_and_push "human" was called
3. git commit failed — no git identity on runner
4. set -e suspended (function called from if) → git push ran → "Everything up-to-date"
5. post_reviews_terminal "human" "applied" "Changes committed and pushed." fired falsely
6. All agent fixes lost; SonarCloud still failing on PR ci: add required ci.yml workflow #80

Fix

1. Add git identity config step to dev-lead.yml before writer steps run
2. Fix commit_and_push to explicitly fail when git commit fails (add || return 1)
3. Add WebFetch to run_writer allowed tools in engine.sh