Auto-commit hook and cw should guard against main branch

[sylvansys]

Summary

A worktree (claude-focused-raven-lo9d0zm2) was checked out directly on main, and the auto-commit hook (commit-session-await-ci-status.ts) fired 38 times in ~10 minutes, all landing directly on local main. This advanced local main past origin/main, which then caused cw to fail with "failed to update local main" (the git fetch origin main:main fast-forward update in claude-worktree.sh:680 can't handle divergence).

What happened

• Session e2ecb8e8 ran in the worktree with HEAD on main
• The stop hook auto-committed every ~15 seconds between 22:25–22:35 PST on Jan 28
• 38 "Session work" auto-commits + 1 manual commit landed on local main
• Local main diverged from origin/main, breaking cw constellos for all subsequent invocations
• Fix was manual: remove worktree, git branch -f main origin/main

Proposed fixes

1. Auto-commit hook: refuse to commit on main/master

File: plugins/github-orchestration/hooks/commit-session-await-ci-status.ts

getCurrentBranch() result should be checked before committing. If on main or master, skip the auto-commit and log a warning. The hook should also use detectWorktree() from shared/hooks/utils/worktree.ts (already used by other hooks) rather than relying solely on getRepoRoot().

2. cw: prevent worktree creation on main/master

File: claude-worktree.sh

The script should validate that the target branch for a new worktree isn't main/master, or at minimum warn before proceeding. This is a defense-in-depth measure — worktrees should always be on feature branches.

Affected files

• plugins/github-orchestration/hooks/commit-session-await-ci-status.ts — auto-commit logic (lines ~1147–1192)
• claude-worktree.sh — worktree creation and branch validation
• plugins/nextjs-supabase-ai-sdk-dev/shared/hooks/utils/worktree.ts — existing worktree detection utility (should be reused)