Fix worktree cleanup for branches without upstreams

[cf-x]

Summary

• measure worktree-only commits against the main worktree HEAD instead of @{push}
• fail closed when git status, git rev-parse, or git rev-list cannot verify cleanup safety
• keep the s18 documentation in all three languages aligned with the corrected behavior
• add regression coverage across s18, s19, and s20

Root cause

create_worktree() creates wt/<name> branches without an upstream. The previous git log @{push}..HEAD --oneline check therefore exited with status 128. Because the return code was ignored, its empty stdout was interpreted as zero commits, allowing a clean worktree with local-only commits to be force-removed along with its branch.

A temporary worktree branch should not need an upstream for cleanup safety. The relevant baseline is the main worktree HEAD: commits reachable only from the temporary worktree must prevent removal unless discard_changes=true is explicit.

Validation

• python -m pytest -q (28 passed, 48 subtests passed)
• python -m py_compile s18_worktree_isolation/code.py s19_mcp_plugin/code.py s20_comprehensive/code.py tests/test_worktree_cleanup.py
• git diff --check

AI assistance

Codex assisted with reproducing the issue, implementing the fix, and running the tests. I reviewed the code and stand behind this change.

Fixes #476