feat(auto-merge): merge additive branches, refuse everything else

Closes the branch pile-up: a catalogue branch that only adds notes now
merges into main by itself, so the work is actually in the vault rather
than waiting in a branch nobody opened.

Additive-only is measured from the diff, not assumed from the mission
type. Three conditions, all required: the type declares additive_only,
the run verified, and `git diff --name-status base...branch` contains
only A entries. A research harvest that somehow rewrote a hand-written
note is refused by the same check that lets its new notes through —
which is the case the test pins down, asserting README.md on main is
byte-identical afterwards.

Renames and deletes count as non-additive. A rename is a delete plus an
add and the delete half can destroy hand-written work.

Unknown merge_policy values fail closed to Never. A typo must not grant
auto-merge.

The diff is taken against FETCH_HEAD, freshly fetched, using `...` so an
unrelated commit landing on main meanwhile is not misread as ours. A
conflicted merge aborts and leaves the branch for a human rather than
wedging the checkout for the next run.

merge_reason is always populated and surfaced in the API: a branch that
quietly did not merge is indistinguishable from one never delivered.

399 tests, clippy clean.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/cm-api/src/routes/library.rs

@@ -37,6 +37,8 @@ pub struct RunResponse {
     pub notes: Vec<String>,
     pub branch: String,
     pub pushed: bool,
+    pub merged: bool,
+    pub merge_reason: String,
     pub error: Option<String>,
     /// A run that errored on nothing. Reported explicitly so a caller does not
     /// have to infer health from an empty `shelved` list — a quiet week and a
@@ -102,6 +104,8 @@ pub async fn run(
         healthy: out.harvest.healthy(),
         branch: out.branch,
         pushed: out.pushed,
+        merged: out.merged,
+        merge_reason: out.merge_reason,
         error: out.error,
     }))
 }