Fetch origin and cut agent branches from origin/HEAD at spawn

Agents spawned by handler were getting branches several commits behind
main. Two compounding causes: sync_project ran 'git pull --ff-only' in
the project root, which only moves whichever branch the root checkout
happens to be on — an agent parked on a feature branch left origin/*
stale (and the pull's 'no tracking information' failure degraded to an
easy-to-miss sync_note). Then worktree spawns cut new branches from the
root's HEAD, inheriting that stale state.

sync_project now fetches origin (refreshing origin/* regardless of the
checkout), re-pins origin/HEAD, and fast-forwards the checkout only when
it sits on the default branch — a diverged default branch still fails
loudly. New worktree branches are cut from origin/HEAD with --no-track
so they start at the remote default branch's tip and don't adopt it as
upstream.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7mF6qeryi9nJthaxYkfPm

tests/test_project_from_server.py

@@ -150,7 +150,7 @@ def test_sync_endpoint_400_without_remote(client, auth, env, tmp_path):
 @pytest.fixture
 def fake_sync_gitops(monkeypatch):
     """Fake the clone/pull side of the gitops seam."""
-    state = {"clone": [], "pull": [], "config": [], "repos": set(), "ok": True, "out": ""}
+    state = {"clone": [], "fetch": [], "config": [], "repos": set(), "ok": True, "out": ""}
 
     def is_repo(path):
         return path in state["repos"]
@@ -162,17 +162,25 @@ def fake_sync_gitops(monkeypatch):
             state["repos"].add(dest)
         return state["ok"], state["out"]
 
-    def pull_ff(cwd, env=None):
-        state["pull"].append({"cwd": cwd, "env": env or {}})
+    def fetch(cwd, env=None):
+        state["fetch"].append({"cwd": cwd, "env": env or {}})
         return state["ok"], state["out"]
 
+    def set_default_head(cwd, env=None):
+        return True, ""
+
+    def default_branch_ref(cwd):
+        return None
+
     def config_local(cwd, key, value):
         state["config"].append({"cwd": cwd, "key": key, "value": value})
         return True, ""
 
     monkeypatch.setattr(gitops, "is_repo", is_repo)
     monkeypatch.setattr(gitops, "clone", clone)
-    monkeypatch.setattr(gitops, "pull_ff", pull_ff)
+    monkeypatch.setattr(gitops, "fetch", fetch)
+    monkeypatch.setattr(gitops, "set_default_head", set_default_head)
+    monkeypatch.setattr(gitops, "default_branch_ref", default_branch_ref)
     monkeypatch.setattr(gitops, "config_local", config_local)
     return state
 
@@ -192,7 +200,7 @@ def test_cmd_sync_clones_then_pulls(env, fake_sync_gitops):
 
     result = worker.execute_command(command)
     assert result["action"] == "pulled"
-    assert fake_sync_gitops["pull"][0]["cwd"] == "/tmp/r"
+    assert fake_sync_gitops["fetch"][0]["cwd"] == "/tmp/r"
 
 
 def test_cmd_sync_failure_is_command_error(env, fake_sync_gitops):