#568 fix(pstack): worktree-audit takes the merge base as -b instead of hardcoding origin/main

Fixes #567.

worktree-audit.sh checked MERGED against a literal origin/main, so a repo whose PRs target another branch got a wrong column and a wrong safe bucket.

Change

• worktree-audit.sh [-b|--base <ref>] [repo-path]. worktree-audit.sh [repo-path] keeps working.
• Without -b the base is git symbolic-ref --short refs/remotes/origin/HEAD, then origin/main, then origin/master. The choice goes to stderr.
• The table header prints # base: <ref>.
• The fetch targets the chosen base instead of main, and only when the base is an origin/* ref.
• -h/--help prints the usage block. Before, -h went to cd. Unknown options and -b without a ref exit 2. A missing base ref exits 1.
• Playbook step 1 shows the new usage and says when to pass -b.

Verification

Run against a repo with 8 worktrees where origin/HEAD is origin/main and PRs target origin/integration.

case	result
-b origin/integration	header # base: origin/integration. Rows marked YES match git merge-base --is-ancestor <branch> origin/integration run by hand for the 3 branches I checked.
no -b	warn: no -b given; MERGED checks against origin/main, header # base: origin/main
-b origin/nao-existe	error: base ref not found: origin/nao-existe, exit 1
-b	error: -b needs a ref, exit 2
--bogus	error: unknown option: --bogus, exit 2
-h	usage block, exit 0
no origin/HEAD, repo with only origin/master	warn: ... checks against origin/master, header # base: origin/master
repo with no origin	error: no base ref (...); pass -b <ref>, exit 1
-b master (local ref)	runs, fetch skipped
path that is not a git repo	error: not a git repo: /tmp, exit 1

bash -n passes.

Notes

• This overlaps #492 in worktree-audit.sh and in playbook step 1, so whichever lands second needs a rebase. The changes are independent: #492 changes how safe is decided, this changes which ref MERGED is computed against.
• Not tested: gh or jq missing.
• Unchanged: a nonexistent repo-path still fails at cd with the shell's message.
• No version bump, left to the maintainer.

---

[!NOTE]
Low Risk
Changes a read-only local audit script and playbook text only; wrong merge base could mis-label buckets before human-gated deletion, and this PR corrects that behavior.

Overview
Fixes worktree audit merge detection when PRs do not target the repo default branch. worktree-audit.sh no longer hardcodes origin/main for the MERGED column and safe bucket hints.

The script accepts -b|--base <ref> (e.g. origin/integration) and prints # base: <ref> in the table. Without -b, it resolves origin/HEAD, then origin/main, then origin/master, warns on stderr, validates the ref, and fetches only for origin/* bases. -h/--help and clearer errors for bad flags or missing refs were added.

The worktree-cleanup playbook step 1 documents the new usage and when to pass -b.

^{Reviewed by Cursor Bugbot for commit 9890ff8e84404e34c106b6824281db95208fc924. Bugbot is set up for automated code reviews on this repo. Configure here.}