fleet-queue(validate): payload identity accepts placeholders — prs:[null], prs with string/absent numbers, and set:{} all validate with no usable identity

Evidence (verified this run, laptop primary @ 4fb0927)

pkgs/fleet/crates/fleet-queue/src/validate.rs, manual_schema_errors (identity block, ~lines 114–125):

• has_issue only requires issue.number to be an integer (is_i64) — sign unchecked.
• has_prs only requires the prs array to be non-empty — its elements are never inspected there. The dedupe cross-check (dedupe_errors) extracts PR numbers with filter_map(... as_i64), so elements without an integer number silently vanish from the cross-check instead of failing it.
• has_set accepts any object, including {}.
• has_source (the one strict alternative) does require an integer pr + non-empty finding — but its pr sign is also unchecked.

Probe with the shipped validator (laptop ~/fleet-brokers/bin/repo-queue validate, probe dir ~/git/fleet/probe-validate-identity), starting from the real packet for #5424 (hidden_files/packet-5424-fix.json, dedupe repo-health:v1:fix:developing-today/code:issue:5424):

Compatibility check: across every packet in the fleet's own hidden_files/packet-*.json corpus, all 87 non-empty prs elements are objects with an integer number, and real set objects carry content (e.g. {"prs": [605, 620]}) — so requiring real identity shapes breaks no legitimate packet shape in use.

Why it matters

The payload identity is the machine-readable binding a queue worker acts on: which issue to fix, which PRs to shepherd, which set a remainder belongs to. A packet that validates with a placeholder identity enqueues cleanly and only fails later — at claim/work time, against a worker that cannot tell which GitHub object it owns. #5482/#5510 closed the same class of hole in dedupe keys; this is the same hole in the payload the key points at.

Acceptance criteria

• prs satisfies identity only when it is non-empty and every element is an object with a positive-integer number.
• set satisfies identity only when it is a non-empty object.
• issue.number, when an issue object is present, must be a positive integer to satisfy identity (and a non-positive one is an error, not silently ignored).
• source.pr must be a positive integer.
• Unit tests pin variants A–C above as invalid and the control packet shape as valid; cargo test -p fleet-queue green.
• No change to dedupe-key matching (fleet-queue(validate): pr-set dedupe keys accept non-canonical spellings (single/repeated number) and maintenance keys accept impossible ISO weeks (W99) #5482/fleet-queue(validate): dedupe keys accept leading-zero spellings (issue:05424) and number 0 in the fix/triage/pr/set families #5510 behavior unchanged).