#574 fix(pstack): worktree-audit checks MERGED against the default branch, not origin/main

Supersedes #568. Fixes #567.

worktree-audit.sh checked MERGED against a literal origin/main. In a repo whose default branch is master, a merged branch showed MERGED=no and landed in the review bucket.

This is #568 by @heliowap, rebased onto main, with the Bugbot finding on that PR fixed. The commits with their code credit them with a Co-authored-by trailer.

Change

• Without -b, the base is origin/HEAD, then origin/main, then origin/master. The choice goes to stderr.
• -b|--base <ref> sets the base when PRs target another branch. worktree-audit.sh [repo-path] keeps working.
• For an origin/* base, the script fetches first, then checks that the ref exists. The fetch uses an explicit refspec, because a plain git fetch origin release does not create origin/release in a single-branch clone.
• The table header prints # base: <ref>.
• -h/--help prints the usage block. Before, -h and --help went to cd. An unknown option or -b without a ref exits 2. A missing base ref exits 1.
• Playbook step 1 shows the new usage.

Differences from #568

• Fetch before the existence check. On #568, -b origin/release exits 1 with base ref not found when that branch is not fetched yet, because the check runs before the fetch.
• The fetch uses an explicit refspec, so the fix also works in a single-branch clone.
• Rebased past #571, which changed the line next to playbook step 1.

Everything else is #568's code and text.

Verification

Throwaway repos with a local bare remote. Each cell is the merged worktree's MERGED and bucket, or the exit code.

Case	main	#568	this PR
master default, merged worktree	no, review	YES, safe	YES, safe
master default, no origin/HEAD	no, review	YES, safe	YES, safe
main default, merged worktree	YES, safe	YES, safe	YES, safe
-b origin/release, branch not fetched	exit 1 (no -b)	exit 1, base ref not found	YES, safe
same, single-branch clone	exit 1 (no -b)	exit 1, base ref not found	YES, safe
-b origin/does-not-exist	n/a	exit 1	exit 1, base ref not found
-b with no ref	n/a	exit 2	exit 2
-b master (local ref, no fetch)	n/a	YES, safe	YES, safe
-h	exit 1, cd: -h: invalid option	exit 0, usage	exit 0, usage
--help	exit 1, prints bash's cd help	exit 0, usage	exit 0, usage
--bogus	exit 1, cd: --: invalid option	exit 2, unknown option	exit 2, unknown option
path that is not a git repo	exit 0, empty table	exit 1, not a git repo	exit 1, not a git repo

Unmerged worktrees show MERGED=no in every column. bash -n passes. No version bump.