Twinned from https://github.com/cfsh/ninefold/issues/823 by tools/beads/import_github.py's reconcile pass.
Piece A of #818, split out so it can land independently of the bare-repo migration (piece B) and the provisioning runbook (piece C, done in cfsh/nf-office).
Add one guardrail line to notes/merging.md (or wherever this tier's git conventions live): never git checkout/switch branches in the shared base clone (/root/nf/ninefold and equivalents on other boxes). If a test needs "a branch checked out somewhere else," create a scratch worktree for it and remove it after.
Context: nf-dev-merge-reset-guard did exactly this on 2026-08-10 while constructing a test scenario, and it blocked git fetch origin +main:main (the #810 mechanism) for every other worktree on the box until the CTO detached it by hand — see #818's incident writeup. Piece B (converting the shared clone to bare) makes this structurally impossible going forward, but the guardrail is worth landing regardless of timing.
None.
No comments.