Move pre-push ancestry guard to .github/workflows (activate it)

.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md

@@ -62,6 +62,7 @@ Before calling `push_to_pull_request_branch`, call `ready_to_make_pr` and apply
 - **Fork PRs**: Cannot push to fork PR branches. Check via `pull_request_read` with method `get` whether the PR head repo differs from the base repo. If it's a fork, explain that you cannot push and suggest the author apply changes themselves.
 - **Committed changes required**: You must have locally committed changes before calling push. Uncommitted or staged-only changes will fail.
 - **Branch**: Pushes to the PR's head branch. The workspace must have the PR branch checked out.
+- **No history rewrites before push**: Read the original PR head SHA from `/tmp/pr-context/pr.json` and run `git merge-base --is-ancestor "<pr-head-sha>" HEAD` before calling push. If this fails, do not call `push_to_pull_request_branch`; explain that local history was rewritten (for example by rebase/reset/cherry-pick flows) and re-apply the needed changes as direct file edits on top of the existing PR head.
 - You may not submit code that modifies files in `.github/workflows/`. Doing so will cause the submission to be rejected. If asked to modify workflow files, propose the change in a copy placed in a `github/` folder (without the leading period) and note in the PR that the file needs to be relocated by someone with workflow write access.
 
 Trying to resolve merge conflicts? Do NOT create merge commits (commits with multiple parents) — `push_to_pull_request_branch` uses `git format-patch` which breaks on merge commits. This means: no `git merge`, no `git rebase`, no `git commit-tree` with multiple `-p` flags. Instead: