add agentws prune

Agents leave their managed worktrees behind, and `agentws rm` takes one path at
a time with no idea whether a branch's work is safely upstream, so clearing an
accumulation by hand risks destroying unmerged commits.

- classify every managed worktree: dirty, PR open, upstream, or unproven
- remove only what is safe; delete the local branch only when work is upstream
- prove "upstream" with merge-base and git cherry, so squash merges count
- match a PR by head.label, which survives the branch deletion a merge does
- dry run by default; --yes applies, --keep-branches spares every branch
- read the Gitea path from origin's URL rather than assuming the owner

AGENTS.md

@@ -19,7 +19,7 @@ like repospawner can run these tools as itself.
   repos into the source root (`~/src/prodenv/<repo>`), creates worktrees under
   the worktree root (`~/.cache/agentws/<repo>__<branch>`), and authenticates
   clone/fetch/push via an ephemeral credential helper. Subcommands: `new`,
-  `list`, `rm`, `clean`, `token`, `credential`.
+  `list`, `rm`, `prune`, `clean`, `token`, `credential`.
 
 All tools are separate `main` packages under `cmd/` and share the
 `internal/agent` package (Vault AppRole login, Gitea REST client, PR-ref
@@ -31,6 +31,7 @@ parsing, watch-state comparison, git worktree helpers).
 cmd/agentpr/main.go      # agentpr CLI (pr create / pr comment / whoami)
 cmd/watchpr/main.go      # watchpr CLI (poll + meaningful-change exit)
 cmd/agentws/main.go      # agentws CLI (new / list / rm / clean / token / credential)
+cmd/agentws/prune.go     # agentws prune (classify worktrees, remove the safe ones)
 cmd/agentvault/main.go   # agentvault CLI (seed-outpost / seed-oauth)
 internal/agent/          # shared plumbing:
   token.go               #   env config + in-process Gitea-token cache
@@ -186,5 +187,11 @@ wrapped per stage (login / read denied / write denied) via `ErrVaultDenied`.
   `seed-oauth` reports key names only.
 - `--rotate` regenerates the `client_secret` too, which then no longer matches
   the IdP provider unless that is rotated alongside.
+- `agentws prune` is a dry run unless `--yes`. It matches a branch to its PR on
+  `head.label`: Gitea rewrites `head.ref` to `refs/pull/<n>/head` once the branch
+  is deleted, which merging does, so `head.ref` matching misses every merged PR.
+  Git signals (`merge-base --is-ancestor`, `git cherry`) are authoritative and
+  offline-safe; an unreachable Gitea only means no branch gets deleted without
+  git proof.
 - CI "combined status" comes from `/commits/{sha}/status`; an empty head SHA
   yields an empty state without an API call.