fix(gbrain): brain worktree advances on the daily sync — no more silently stale brains (#2516)

The daily pull refreshed only ~/.gstack itself, never the detached worktree
at ~/.gstack-brain-worktree that gbrain actually indexes — so after setup the
brain served stale pages forever unless setup-gbrain/sync-gbrain happened to
run. brain-sync --once now advances the worktree once per 24h behind an
ATTEMPT stamp (.brain-worktree-last-advance — a persistently-failing advance
warns once a day, not at every skill boundary), inside the existing run lock
and before any ingest step touches the worktree.

The new gstack-gbrain-source-wireup --advance-only is built for the
unattended cadence: git-only (no gbrain prereqs), pins every operation to the
managed worktree (refuses paths that are not worktrees of the artifacts
repo), refuses dirty worktrees, and never runs the force-remove recovery — a
cron path must not be able to delete local changes. A static pin keeps the
force-remove out. docs/gbrain-sync.md stops overclaiming the old cadence.

Fixes #2516.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/gbrain-sync.md

@@ -166,6 +166,14 @@ The preamble runs `git fetch` + `git merge --ff-only` once per 24 hours
 (cached via `~/.gstack/.brain-last-pull`). You don't need to think about
 this — it happens automatically at the first skill invocation each day.
 
+Historical note (#2516): that daily pull refreshed only `~/.gstack` itself —
+NOT the detached worktree at `~/.gstack-brain-worktree` that gbrain actually
+indexes, so the brain silently served stale pages until the next
+setup-gbrain/sync-gbrain run. Since this fix, the daily sync also advances
+the brain worktree (`gstack-gbrain-source-wireup --advance-only`, throttled
+via `~/.gstack/.brain-worktree-last-advance`); a failed advance warns instead
+of failing silently, and never force-resets a dirty worktree.
+
 ## Uninstall
 
 ```bash