Find every stale worktree, not just the managed ones

- discover worktrees from `git worktree list` on each source checkout, not only
  the worktree root, so hand-made ones, stale registrations and orphaned
  directories are classified too
- normalise each candidate to its main checkout, so a linked worktree in the
  source root cannot offer up the repo's real checkout
- keep locked, mid-rebase and detached-with-unique-commits worktrees, whose
  removal would destroy state nothing else holds
- name the retained branch in every unproven verdict
- add --no-fetch, --json, --include-unmanaged and --include-keep

README.md

@@ -104,8 +104,10 @@ agentws list
 agentws rm benvin/my-change
 agentws rm ~/.cache/agentws/argocd-apps__benvin-my-change --delete-branch
 
-# Classify every managed worktree; dry run unless --yes is given
+# Classify every worktree found; dry run unless --yes is given
 agentws prune
+agentws prune --json
+agentws prune --no-fetch
 agentws prune --yes
 agentws prune --yes --keep-branches
 
@@ -118,16 +120,26 @@ agentws token
 
 ### prune
 
-`agentws prune` decides, per worktree, whether its work is safely upstream:
+`agentws prune` finds worktrees two ways and merges the results: the managed
+directories under the worktree root, and `git worktree list` on every source
+checkout — so hand-made worktrees, stale registrations whose directory is gone,
+and leftover directories whose source repo was deleted all show up too.
+
+It then decides, per worktree, whether its work is safely upstream:
 
 | Signal (first match wins) | Verdict |
 |---|---|
-| uncommitted or untracked changes | keep |
+| working tree gone (registration only) | prune the registration |
+| backing repo gone | delete the leftover directory |
+| locked by `git worktree lock` | keep |
+| rebase, merge, cherry-pick, revert or bisect in progress | keep |
+| uncommitted, staged or untracked changes | keep |
 | branch has an open PR | keep |
 | tip contained in `origin/<default>` | remove worktree + local branch |
 | every commit patch-equivalent to one in `origin/<default>`'s history | remove worktree + local branch |
 | PR merged **and** HEAD contained in the PR's head commit (or in a verified `origin/<branch>`) | remove worktree + local branch |
 | PR closed **and** HEAD contained in a verified `origin/<branch>` | remove worktree + local branch |
+| detached HEAD carrying commits on no remote | keep |
 | anything else | remove worktree, keep the branch |
 
 A branch is deleted only where git proves its commits survive elsewhere. PR
@@ -155,7 +167,25 @@ hits the pagination cap is reported rather than read as "no PR". Matching a
 branch to its PR uses `head.label`, since Gitea rewrites `head.ref` to
 `refs/pull/<n>/head` once the branch is deleted on merge.
 
-`--keep-branches` removes worktrees only, and its verdicts print as `remove`.
+The last row is safe only because the local branch keeps the commits, so the
+reason names the branch it is relying on. A detached HEAD has no such branch, so
+unique commits there are kept instead.
+
+Output is a table (`REPO BRANCH PATH VERDICT REASON`) with every verdict's reason
+spelled out, or `--json` for scripting. Neither form needs a terminal.
+
+| Flag | Effect |
+|---|---|
+| `--yes` | apply the plan; without it nothing is touched |
+| `--keep-branches` | remove worktrees only; verdicts print as `remove` |
+| `--no-fetch` | judge against the refs already on disk, for offline use |
+| `--json` | emit the report as JSON on stdout, notes on stderr |
+| `--include-unmanaged` | also remove worktrees outside the worktree root |
+| `--include-keep` | dangerous: also remove worktrees classified `keep`, never their branch |
+
+Without `--include-unmanaged` a hand-made worktree is reported and then skipped,
+naming the flag that would remove it. `--include-keep` is the only way past a
+`keep`, and it still leaves the branch, so the commits outlive the worktree.
 
 ### Auth / credential-helper design