Push feature branches with -u, or have wrap_up.py/dev.py warn on a branch with no upstream nf-y1w ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/817 by tools/beads/import_github.py's reconcile pass.

Unclaimed and unlabelled — filed per CLAUDE.md value 4 (strategic uplifts get filed, not claimed), split out from #795 so it survives that issue closing.

Background

#795 (fixed by #810) was a merge_pr.py bug where the post-merge sync could hard-reset whatever branch happened to be checked out, discarding 9 commits including one never pushed. #795's own comment thread (2026-08-10, from bork/#809) found a second, independent gap that made the damage invisible for three interactions instead of one:

> The clobbered branch had no upstream at all — pushed with git push origin <branch> rather than git push -u. With an upstream set, git status -sb would have read [behind 9] the moment the reset landed.

And, sharpened in the same thread:

> "the complete fix is the pair, and neither half works alone": branch.autoSetupMerge=false (#809, shipped) means nothing tracks the WRONG ref; push -u (this issue) means everything tracks the RIGHT one. With autoSetupMerge=false now global, -u is the *only* way a feature branch gets a correct upstream.

#810's review (GAPS, F row 4) confirmed this is real and correctly out of scope for a merge_pr.py-only PR — "different files, different cognitive level" — and flagged that Closes #795 would otherwise retire this finding in a closed thread nobody re-reads.

Suggested shapes (from #795's own comments)

1. Have CLAUDE.md's loop push with git push -u origin <branch> instead of a bare git push origin <branch> (the loop currently says gh pr create, which doesn't itself set an upstream).
2. Or have wrap_up.py/dev.py warn when a session's branch has no upstream — one git status -sb check, cheap.

Scope note from the same thread (confirmed empirically, bork/#809): this is not a wrap_up.py safety fix — nflib.sessions.check_commits already counts unpushed commits via git rev-list --count HEAD --not --remotes, which doesn't consult the upstream at all. This is purely about visibility during work — an upstream is what lets git status show [behind N] the moment something clobbers a branch, which is exactly and only the gap #795 measured.

Refs #795, #809.