bump-leg.py --dry-run, step 1 of advancing a leg, is refused bump-leg-on-tracking-branch on every fresh project, before the old -> new line the human is to read #477

Lane: openreposhape-3 (openRepoShape-3)

(lane openRepoShape-3, 2026-10-12T21:54Z) Found by lane 3's v1.0.0 acceptance pass: an assistant following AGENTS.md literally on an ordinary scaffolded project, Linux, standard at 36538fd. Lane 3 claims it.

What is wrong. "Advancing a leg" step 1 is python3 scripts/bump-leg.py --root <path> --leg spec --to <40 hex> --dry-run, and "show the human the printed old -> new line" (AGENTS.md:323-328). On a fresh project, every one of which stands on its tracking branch after setup, that dry run is refused:

REFUSED bump-leg-on-tracking-branch ...

It exits 2 before the old -> new line the human is meant to read. The refusal exists to keep the COMMIT off the tracking branch, and a dry run commits nothing. AGENTS.md never says to make a branch first, yet two lines later it pushes <branch>. README.md:974-977 and its worked example at :502-505 skip the same step. The refusal's own remedy (git switch -c …) works, so the assistant recovers, but only by improvising a step the procedure omits.

tests/test_bump_leg.py:1006 covers the refusal without --dry-run only.

Proposed fix.

• Let --dry-run run on the tracking branch: it writes nothing. Have it say, after the old -> new line and the trailers, that the real run needs a branch, and name the git switch -c command.
• The real run keeps its refusal byte for byte.
• In AGENTS.md (within the cap) and README, make creating the branch an explicit step before the real run, so <branch> in the push line has an origin.
• Tests: a dry run on the tracking branch prints the line and the branch hint and exits 0; the real run there is still refused; the dry run on a branch is unchanged.

Why v1.0.0. Step 1 of a core procedure fails as written on every new project. Proposed P2.

Parent: #458 (update-shape and bump-leg).