Distrust origin/<branch> when prune's fetch fails

A stale remote-tracking ref survives a failed fetch and the next successful
--prune deletes it, so it cannot prove a branch's commits survive upstream.
Record whether the pruning fetch succeeded and gate the origin/<branch>
existence and containment proofs on it; a failed fetch removes the worktree and
keeps the branch. Local-object proofs and the merged head SHA are unaffected.

AGENTS.md

@@ -194,6 +194,8 @@ wrapped per stage (login / read denied / write denied) via `ErrVaultDenied`.
   offline-safe; an unreachable Gitea only means no branch gets deleted without
   git proof. A PR's state never authorises a branch delete on its own — HEAD
   must be contained in the PR's head commit or in `origin/<branch>`, otherwise
-  the worktree goes and the branch stays.
+  the worktree goes and the branch stays. `origin/<branch>` is only evidence when
+  this run's pruning fetch succeeded; a failed fetch leaves stale tracking refs,
+  so those verdicts fall back to keeping the branch.
 - CI "combined status" comes from `/commits/{sha}/status`; an empty head SHA
   yields an empty state without an API call.