feat(repo): add safe main-update skill

[kyleve]

Posted by an AI agent on kve’s behalf.

Summary

• add an explicit-only $update-main repository skill for ordinary primary checkouts
• reuse ./worktree --update-main for fetch, ancestry validation, and fast-forward behavior
• refuse linked worktrees, non-main branches, detached HEADs, and dirty checkouts before updating

Why

The existing environment action in .codex/environments/environment.toml is available to Codex-managed worktrees, but ordinary checkouts need an equally safe command-driven path.

Review focus

• the Git-directory/common-directory comparison is the boundary between a linked worktree and the primary checkout
• implicit invocation is disabled because this workflow fetches and moves main

Testing

• skill creator quick_validate.py
• ./sync-agents
• ./attribution --check
• exercised the checkout guard against the current linked worktree and /Users/kve/Development/Stuff primary checkout
• ./test and ./swiftformat --lint not run: only skill Markdown and UI metadata changed