Add scripts/agent_startup.sh — a sourced bash guard that prevents
stale-base worktrees from silently replaying or creating conflict PRs.
Root cause: PR #844 was opened from a worktree whose HEAD was behind
origin/main. The resulting replay produced a conflict-laden PR that
required manual reconciliation (see PR #847).
## Behaviour
Default (new implementation task):
HEAD must equal origin/main
Working tree must be clean
→ source scripts/agent_startup.sh
PR-resume task:
CODEX_ALLOW_NON_MAIN_BASE=1 source scripts/agent_startup.sh
origin/main must be a strict ancestor of HEAD (enforced via merge-base)
Debug-only dirty override:
CODEX_ALLOW_DIRTY=1 source scripts/agent_startup.sh
## Steps performed by the script
1. git fetch origin --prune
2. Print HEAD / branch / origin/main / merge-base
3. Fail if dirty (unless CODEX_ALLOW_DIRTY=1)
4. Fail if HEAD != origin/main (unless CODEX_ALLOW_NON_MAIN_BASE=1)
5. In resume mode, verify origin/main is ancestor of HEAD via merge-base
6. Print diff --name-status vs origin/main
7. Verify uv exists
8. uv sync --frozen only when uv.lock is present
9. Print final git status
## Escape hatches
CODEX_ALLOW_NON_MAIN_BASE=1 PR-resume, ancestry enforced
CODEX_ALLOW_DIRTY=1 Debug/WIP sessions, documented in session log
## Validation
bash -n scripts/agent_startup.sh → OK
git diff --check → OK (no trailing whitespace)
shellcheck not available locally; shebang is bash, bash -n passed
## Non-goals
Does not touch runtime, evals, reports, teaching proposals, packs,
policy, identity, recall, vault, field, algebra, or serving paths.
4b51ba146d