Harden destructive worktree workflows

[sauravpanda]

Summary

• require confirmation before push --remove deletes a worktree, with explicit --yes support for approved automation
• surface rebase/merge abort failures after an unsuccessful sync
• make list --no-pr exclude unknown PR states
• clear false unpushed warnings when GitHub confirms the exact merged PR head
• use an ASCII range in rm validation errors for terminal compatibility

Why

Several destructive and recovery paths either acted without a final approval or hid state that users need to make a safe decision. PR lookup failures were also conflated with “no PR,” and squash/rebase merges could look unpushed even when GitHub recorded the exact branch head as merged.

Impact

Worktree removal after push is now opt-in at the final step, failed cleanup after sync conflicts is visible, and list/filter output distinguishes verified state from unknown state. Automated callers can still use push --remove --yes after obtaining approval.

Validation

• go mod verify
• go build ./...
• go vet ./...
• go test ./... -count=1
• go test -race ./... -count=1
• focused tests for PR filtering, merged-head reconciliation, portable range errors, removal approval, and sync-abort failures

Closes #51
Closes #52
Closes #53
Closes #54
Closes #67