#3147 chore(claude): allow origin/main delivery worktrees in auto mode

Summary

• Adds a user-scope autoMode block to config/claude/settings.json and its template.
• environment: the defaults, plus one entry saying another worktree of the session's repository on the host is the same trusted repo.
• allow: the defaults, plus "Delivery Checkout at origin/main". This covers fetching origin, creating a worktree detached at origin/main (including git -C <repo> forms and && chains), and running bun install --frozen-lockfile in it.
• The allow entry does not cover other refs, running other code from that worktree, or the merge itself. Merge Without Review is unchanged.

Why

The classifier denied this compound command as [Auto-Mode Bypass] while a three-PR stack in the session's repository was being merged:

git -C <repo> fetch && git -C <repo> worktree add --detach <dir> origin/main && bun install ...

That worktree was where stack:merge asked to be rerun after it refused stale tooling. Existing permission allow rules cannot fix this:

• Bash(git worktree:*) does not match the git -C form.
• Auto mode drops package-manager allow rules such as Bash(bun:*).
• Each subcommand of a chain must match a rule on its own.

The earlier [Merge Without Review] denial of bun run gh -- pr merge --auto is a classifier category. Bash(gh pr merge:*) never matched it either, since the command ran through bun run. This PR leaves that category in place. The repository-side fix is that stack:merge now points at the host's canonical checkout, which needs no new worktree.

Verification

• CLAUDE_CONFIG_DIR=<tmp> claude auto-mode config with the new settings: 22 environment entries (21 defaults + 1) and 18 allow entries (17 defaults + 1), so $defaults expands.
• shellspec spec/llm_update_spec.sh spec/activate_config_spec.sh spec/security_spec.sh: 195 examples, 0 failures.

Tracker linkage

• Linear: none - fleet incident corrective action tracked in beads
• Bead: shunkakinokisoftware-12r6v0g

Incident: yes

🤖 Generated with Claude Code