feat(projects): automatically pull clean default branches

[rynfar]

Projects can now keep their default-branch checkout current on their own. Turn on
Automatically pull in a project's settings and Pylon fast-forwards that checkout in the
background and at server start, but only when the checkout is genuinely idle: on the default
branch, with an upstream, and with no working-tree changes, untracked files, or local commits.
Anything else is skipped, and a failed pull never blocks startup.

Adopted from T3 Code

• ba3cb0773859334fe9f75016295bb3893c9e6044 (#9277) automatically pull clean default branches
• f6db4206258b0ef30e8dd8949627acfd209bf338 (#9763) reset automatic pull to default

Cherry-picked with -x; both source SHAs are in the commit trailers.

Pylon adaptations

Migration renumbered 045 → 058. Pylon's migration lineage diverged from upstream's when id
36 was retired, and Pylon already uses 045 for AuthSessionClientConnection. Taking upstream's
number would let any environment that had recorded 045 silently skip the new auto_pull column.
Registered as 058 with a comment following the convention already used for ids 40–57.

The pull runs inside Pylon's remote write lock. Upstream calls maybeAutoPull outside any
lock in both refreshRemoteStatus and refreshStatus. Pylon wraps those bodies in
withRemoteWriteLock, which upstream does not have. Since the pull writes to the checkout,
it belongs inside that lock rather than racing the status refresh it is interleaved with, so
it was placed there.

Dropped an unrelated upstream test. The path-filtered diff carried a
"canonical Codex default for the auto-bootstrapped welcome thread" test that predates #9277
upstream and asserts an exported getAutoBootstrapThreadModelSelection, which Pylon keeps
private. It is not part of this feature, so only the auto-pull policy test was taken.

Docs kept Pylon's voice. The new section says Pylon rather than T3 Code, and upstream's
"To use automatic detection again, select Automatic" line was dropped because the page
already documents Pylon's Reset control a few paragraphs above.

Verification

• 62 tests across 5 files pass, including the ported policy test asserting that only the
  enabled, behind, clean, default-branch checkout is pulled and that dirty, ahead, non-default
  and disabled projects are left alone.
• @t3tools/contracts, @t3tools/web and t3 typecheck clean.
• Lint and format clean across all 20 changed files.
• Migration lineage checked: no duplicate ids, id 36 still retired, 058 is the new maximum and
  its id matches its filename.

No new dependency. One additive migration, backfilling auto_pull to 0, so the feature is
off until a project opts in.

Model and harness: Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.8 KiB	+7 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+9 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−2 B (−0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.4 KiB	57.4 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	−39 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−38 B (−0.6%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.2 KiB	58.2 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: f24356d · PR result: 73bd93e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.