Look inside the worktree before deleting it

Context

The story behind this plan — what prompted the work and why it matters now.

kit/plugins/git-agent/skills/merge/SKILL.md:183 deliberately declines branch
deletion — "Never pass --delete-branch. Branch deletion is a separate
destructive action that needs its own explicit yes." Nothing has ever filled
that seam, so the job falls to commit-commands:clean_gone, an external command
that runs git worktree remove --force plus git branch -D in one unattended
loop with no user gate. Measured against this repo on 2026-08-15, that would
destroy 16 untracked files across 9 of 19 worktrees, because --force exists
precisely to defeat the dirty-tree refusal git worktree remove performs by
default.

That default refusal is the design hinge: because an unforced
git worktree remove already fails on a dirty tree, checking for uncommitted
work first lets this skill delegate its central safety property to git rather
than reimplementing it.

Selection cannot rely on commit ancestry. git-agent squash-merges, and a
squash merge replays a branch's changes as one new commit with a different SHA,
so the branch's own commits never become ancestors of main.
git branch --merged origin/main therefore cannot see squash-merged branches at
all. Measured here across 395 local branches: 84 are ancestry-merged, while
318 have a merged pull request — 296 of those invisible to the ancestry
test. The union is 380 cleanable branches, so selecting on ancestry alone
would find 84 of 380 and miss 78% of the real backlog. git branch -d would
also refuse those 296 even when deleting is correct, because -d performs the
same ancestry check. Selection therefore takes either signal, and -D is
permitted only where a merged PR supplies positive evidence.

The grounded proposal is at docs/prompts/proposal-add-post-merge-cleanup.md.
Note that its "51 branches that never landed" claim was disproved during this
plan's interview and has been corrected there.

Risks carried into this plan:

- Recursive delete inside a skill. Step 6 gives the skill an rm -rf for
unregistered directories, which have no git registration to remove them by,
and whose dangling .git files mean git status cannot vouch for their
contents. Mitigated by printing size, file count, and recently modified files,
requiring a per-directory confirmation, checking containment against the
worktrees root, and refusing any path detection did not itself produce.
- -D is now reachable. Squash-merged branches require it. Mitigated by
gating -D behind a confirmed merged PR; without that evidence the skill uses
-d and accepts git's refusal.
- Self-deletion. The skill can run inside the worktree it is asked to
remove. Mitigated by an explicit cwd check in Step 3.
- Version guard. Any edit under kit/plugins/git-agent/ fails CI without a
marketplace.json version bump. Step 7 does it; nothing else may.