Keep luci-persistent on master and clean-fast-forward origin updates

OVERRIDES runtime profile: uses direct_no_llm because the script only calls git + notify.py; no LLM call.

MC-3840 §15: persistent-luci session must stay anchored on master so CCGram worktree-picker, mc_hook auto-commit, and pool dispatch all see the expected default branch. This task runs every 15 min and enforces that discipline in monitoring.

MC-4718: the same guard now fetches origin/master and performs a live checkout update only when the repo is on the default branch, completely clean, behind origin, and fast-forwardable. Dirty, ahead, diverged, detached, or branch-drifted states are alert-only and never mutated. Alerts are transition-keyed so the task does not page every tick.

Source of truth for the branch discipline: docs/plans/2026-05-20-worktree-pool.md §2 goal 6 + §15.5. Source of truth for the sync gap: docs/solutions/mc-4709-recover-merge-sweep.md / MC-4718.