fix(cleanup): prove squash merges by PR record, ff the local default first, clear worktrees in groups

[SUaDtL]

Summary

This repo squash-merges by default, so post-merge-cleanup Phase 1's SHA-ancestry
check (git merge-base --is-ancestor) failed on every normally-merged branch, while
its own prose asserted squash merges were safe to delete — a self-contradiction.
Phase 4 also assumed the local default ref was current, so a stale local main
could make Phase 3's blocked-checkout STOP misattribute the block to a correctly-kept
artifact instead of the real cause.

• core/surface/skills/post-merge-cleanup/SKILL.md — Phase 1 rewritten from bare
  ancestry to content-containment: ancestry, or a squash-merge proof via the merged
  PR record (headRefOid == HEAD), or (without gh) a byte-identical tree diff.
  Phase 3 now distinguishes a genuinely conflicting kept artifact from a stale local
  default ref. Phase 4 fast-forwards the local default ref (git fetch origin <default>:<default>) before checking it out — git's own refusal of a
  non-fast-forward update on a ref not checked out preserves the --ff-only
  guarantee — with a documented, correctly-attributed STOP if that fetch itself
  refuses (another worktree holding the default). Phase 5 documents why git branch -d already accepts a squash-merged branch via its upstream, and sanctions git branch -D only when this run's Phase 1 proof was the PR-record squash proof and
  -d refused, with the proof restated and the branch named.
• core/surface/commands/cleanup.md and core/surface/skills/INDEX.md —
  hard gate and catalog line reworded to match: containment, not bare ancestry.
• core/surface/commands/standup.md (closes standup/cleanup: stale worktrees can only be cleared one confirmation at a time #596) — stale worktrees can now be
  confirmed for removal as one explicitly enumerated group naming every member,
  falling back to per-item confirmation on decline; branch pruning documents the
  same squash-merge -D exception, scoped identically to post-merge-cleanup.
• site/src/curated/commands/cleanup.md / standup.md — hand-written docs
  aligned with the new contracts (no drift gate covers these).
• Regenerated all three vendored plugin surfaces (plugins/ca, plugins/ca-codex,
  plugins/ca-pi) via tools/build-surface.py; --check and sync-core --check
  both pass.
• Version bumps: ca 2.11.1 → 2.11.3, ca-codex 0.4.0 → 0.4.2, ca-pi 0.2.0 →
  0.2.2 (regenerated repo-root package.json via build-host-packages.py).
  README version badge, the "currently ships ca-codex X.Y.Z" line, and both
  root/ca-pi CHANGELOGs updated to match — each pinned by its own CI gate
  (check_badge_consistency.py, readme-professional.test.ts,
  test_release_trace.py, build-host-packages.py --release-guard-base).

Deviation from #586's suggested contract

#586 suggested the squash-merge proof require git diff --quiet origin/<default> HEAD (byte-identical tree) and the PR record. This PR demotes the diff to
corroboration: requiring it empty re-breaks the gate the instant any later PR merges
to the default branch — the common state on an active repo, not an edge case. The
PR-record identity (MERGED + headRefOid == HEAD) is what proves every commit on
the branch rode that PR's squash into the default; the diff is reported as a fact
either way (empty or not) but is never a requirement.

Test plan

• python tools/build-surface.py --check — OK (claude, codex, pi in sync)
• python tools/sync-core.py --check — OK (56 core files × 3 plugins, byte-identical)
• git diff --check — no CR/whitespace errors
• python -m pytest .github/scripts/test_build_surface.py — 40 passed
• python -m pytest .github/scripts/test_release_trace.py — 29 passed, 34 subtests
• python .github/scripts/test_badge_consistency.py — 11 passed
• python .github/scripts/check_badge_consistency.py — consistent
• python .github/scripts/payload_version_gate.py --plugin plugins/ca --base origin/main — advanced 2.11.1 → 2.11.3
• python .github/scripts/payload_version_gate.py --plugin plugins/ca-codex --base origin/main — advanced 0.4.0 → 0.4.2
• python tools/build-host-packages.py --check --release-guard-base origin/main — advanced 0.2.0 → 0.2.2
• cd site && npm ci && npm run build && npm test — 512/512 passed
• cd site && npm run typecheck — clean
• cd site && npm run link-audit — 20057 internal links resolve
• env -u NO_COLOR python -m pytest plugins/ca/hooks/tests — 1298 passed, 130 subtests; 10 failures confirmed pre-existing/environmental (worktree-checkout git-enforce resolution, not caused by this change — reproduced identically on the unmodified tree via git stash)

Closes #586
Closes #596

https://claude.ai/code/session_01QjJeSbcwPHwMmd6CEZeagB

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 8dac69e5-35c5-4c92-af32-213fc0543ad2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}