feat(orchestrator): W3 artifacts tree, ancestry, gates and token-free cleanup

Artifacts show the branch tree with ancestry and gate marks. The cleanup runner calls pkgmgr branch cleanup with its real argv and parses its repos[*].items output, refuses any plan with a remote-branch action, marks an item done only when pkgmgr reports it done, and offers no delete for a branch a worktree holds. Every text states what the pkgmgr command does to volumes. Committed below the bar on the operator's word 2026-11-12 (no further per-bundle tests, one gate after the merge): the W3 e2e never ran; the client switches to --local once pkgmgr ships it.

🎯 Fix: 90 %
💥 Break: 6 %
💸 Cost: 30 %
⏱️ Time: 40 %
🛡️ Security: 100 %
🏆 Score: 100
🚦 Gate: ⛔ break 6 % > 5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_artifacts.py

@@ -69,6 +69,16 @@ class TestHubIcons(HubCase):
 
 
 class TestHubArtifacts(HubCase):
+    def test_a_merge_pkgmgr_names_into_the_remote_tracking_default_points_at_the_default_branch_node(self):
+        self.write_fixture("branch-tree-tokenless.json")
+        status, _, body = self.get("/api/tree")
+        self.assertEqual(status, 200, body)
+        merges = {repo["name"]: repo["merges"] for repo in json.loads(body)["repos"]}
+        self.assertEqual(merges, {
+            "github.com/anon/web": [{"from": "chore/ancestor-local", "into": "main", "by": "ancestor"}, {"from": "fix/remote-merged", "into": "main", "by": "ancestor"}],
+            "git.example.org/anon/notes": [{"from": "topic/ancestor-local", "into": "master", "by": "ancestor"}, {"from": "topic/patch-local", "into": "master", "by": "patch"}],
+        })
+
     def test_the_tree_carries_artefact_leaves_overlaps_merges_and_lanes(self):
         root = self.write_tree()
         demo = f"{root}/worktrees/github.com/me/demo"