Guard auto-commit hooks and cw against main branch

[sylvansys]

Summary

• Add protected branch guard (main, master, develop) to commit-session-await-ci-status.ts Stop hook — skips auto-commit while still allowing Phase 3 PR status check to proceed
• Add protected branch guard with early return to commit-task-await-ci-status.ts SubagentStop hook
• Add defense-in-depth case validation in claude-worktree.sh to reject generated branch names matching protected branches

Closes #334

Context

A worktree checked out on main caused the Stop hook to fire repeatedly, committing directly to local main and advancing it past origin/main. This broke cw which requires local main to track origin/main.

Test plan

• bun run typecheck passes
• bun run test passes
• Manual: create worktree, checkout main, make a change, stop session — confirm hook logs "Refusing to auto-commit on protected branch: main" and does NOT commit

🤖 Generated with Claude Code

[constellos]

Constellos Review - PR feedback from your reviewer agents.

Requirements: ❌ 0 • ❌ 0 • ⏭️ 0

View agent prompt

Code Quality: ✅ 4 • ❌ 0 • ⏭️ 0

Check	Status	Reasoning
DRY Compliance	✅	No significant code duplication found. The claude-worktree.sh script has some repeated patterns for checking GitHub repos, but these are necessary for different contexts (user repos vs org repos). The two hook files share similar structure but implement different event handlers (Stop vs SubagentStop) with distinct logic.
YAGNI Compliance	✅	All functionality appears necessary and directly supports the stated purposes. The claude-worktree.sh script's features (cache management, repo discovery, auto-update) are all actively used. The hooks implement required validation and commit workflows without speculative features.
Modularity	✅	Code is well-separated into logical concerns. claude-worktree.sh organizes functions by responsibility (cache management, git operations, repo discovery). Both hook files follow clear phases with dedicated functions for git state checks, validation, output formatting, and handler logic. Both hooks properly import shared utilities from '../shared/' rather than duplicating code.
Maintainability	✅	Code is clear, well-documented, and follows consistent patterns. All functions have JSDoc comments explaining purpose and parameters. The hook files use descriptive function names and clear control flow with well-commented phases. Error handling is comprehensive with proper logging. The bash script uses clear variable naming and sectioned organization with comment headers.