#492 fix(pstack): worktree-audit never buckets unpushed or closed-unmerged work as safe

Fixes #470.

worktree-audit.sh could suggest safe for worktrees whose commits exist nowhere else:

• any non-open PR satisfied $pr != "-", so a PR closed without merging made the worktree safe;
• the remote column (aheadN / no-remote / detached) was computed but never read by the bucket logic, so unpushed commits were ignored;
• the header called the script read-only although it runs git fetch origin main.

Change

• Only ancestry of origin/main or a MERGED PR counts as proof the work lives elsewhere. A CLOSED PR falls through to review.
• Worktrees whose HEAD is ahead of / absent from the remote, or detached and not on origin/main, go to a new hold-unpushed bucket, ranked right after hold-wip and hold-open-pr.
• Header now states the one write the script performs (the fetch). Playbook documents the new bucket in step 1; steps 4–5 are untouched so this does not conflict with #459 (which covers the untracked/ignored half of the same script, #449).

Verification

Synthetic repo with a bare origin and a stubbed gh returning PR states:

case	before	after
ahead1, PR #42/CLOSED	safe	hold-unpushed
detached, HEAD not on origin/main	review	hold-unpushed
pushed, PR CLOSED, commits not on main	safe	review
pushed, PR MERGED	safe	safe
pushed, PR CLOSED, HEAD is an ancestor of main	safe	safe
detached on origin/main	safe	safe

bash -n passes. No version bump here — leaving that to the maintainer to coordinate with #459.