fix(#1301): delete stale remote branches before pushing

[fullsend-ai-coder]

When a human closes a code agent PR and re-triggers /fs-code, the old remote branch persists. The post-code script's plain git push fails with non-fast-forward because the new local branch diverges from the stale remote. This caused silent failures requiring manual intervention (e.g., PR #1234 needed 3 attempts).

Changes to post-code.sh:

• Section 7a: before pushing, check if the remote branch exists
  via git ls-remote. If it does and no open PR references it,
  delete the stale remote branch so the fresh push succeeds.
• Section 7b: capture push exit code and output. On
  non-fast-forward errors, retry with --force-with-lease as a
  fallback safety net.
• Error reporting: add an ERR trap that posts a comment on the
  originating issue when the post-code script fails, including
  the exit code and a link to the workflow run. This ensures
  humans get feedback without checking workflow logs.
• Move GH_TOKEN export earlier (before section 7a) since both
  the stale branch check and error reporting need it.

Changes to post-code-test.sh:

• Add stale branch decision tests (no remote, stale with no PR,
  branch with open PR).
• Add push retry decision tests (success, non-fast-forward,
  rejected, unexpected error).
• Add error comment content tests (exit code, workflow link,
  retry hint, warning emoji).

Note: make lint could not run due to a Go toolchain permission error in the sandbox (unrelated to these shell script changes). The post-code-test.sh suite passes all 38 tests.

---

Closes #1301

Post-script verification

• Branch is not main/master (agent/1301-stale-branch-cleanup)
• Secret scan passed (gitleaks — 33244271743c5a6ab9af8038f2bd69e8d1610ab7..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://cc3b9f44-site.fullsend-ai.workers.dev

Commit: e150b30cc14007ffa03979f361b4109f423f2c41

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] internal/scaffold/fullsend-repo/scripts/post-code.sh — This file is under scripts/, a protected path. The PR links to issue Post-code script should delete stale remote branches before pushing #1301 and the description explains the rationale (stale remote branches causing push failures after closed PRs). Human approval is required for all protected-path changes regardless of context. Also applies to internal/scaffold/fullsend-repo/scripts/post-code-test.sh.

Info

• [correctness] internal/scaffold/fullsend-repo/scripts/post-code-test.sh — Tests re-implement the decision logic (stale branch, push retry, error comment) rather than sourcing from the production script. This is a standard pattern for shell scripts where sourcing would execute the main body, but means tests could drift from production if the logic diverges. The current implementations are in sync.

[ralphbean]

LGTM.