The soak check measures `now - dev_HEAD_timestamp >= 24h`, which means
every new merge into dev resets the clock. Under any non-trivial merge
cadence, dev never satisfies the soak gate and master stagnates: PRs
#437/#438/#439/#440/#442 all stacked on dev for a week with no
promotion.

Add a `force_skip_soak` boolean input to workflow_dispatch (default
false). Schedule cron remains untouched and continues to enforce the
24h rule. Only manual triggers can bypass, and only when the operator
explicitly sets the input to true — intended for sync-back / merge
commits whose content has actually been on dev long enough but whose
HEAD timestamp is misleadingly fresh.

Test plan: yaml syntax verified via js-yaml. Functional verification
will be the next manual workflow_dispatch run with the input set.

Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>

applyProxySelfUpdate previously ran `git checkout -- .` followed by
`git pull origin master` unconditionally. Two real consequences:

1. Any uncommitted local change was silently discarded. With dev server
   running under tsx watch, every restart triggered the 10s update
   check; if auto_update was on, the developer's in-flight edits were
   wiped within ~12s of save.
2. The pull merged master into whatever branch was checked out — on
   `dev` this corrupts the dev→master promote contract documented in
   CLAUDE.md.

Add two safety guards before any destructive op:

- Refuse to apply when current branch is not `master` / `main`.
- Refuse to apply when `git status --porcelain` is non-empty.

Drop the silent `git checkout -- .` entirely; if the tree is clean and
on master, plain `git pull` is sufficient. Both refusals return the
existing error envelope so the dashboard / API can surface the reason.

Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>

The soak check measures `now - dev_HEAD_timestamp >= 24h`, which means
every new merge into dev resets the clock. Under any non-trivial merge
cadence, dev never satisfies the soak gate and master stagnates: PRs
#437/#438/#439/#440/#442 all stacked on dev for a week with no
promotion.

Add a `force_skip_soak` boolean input to workflow_dispatch (default
false). Schedule cron remains untouched and continues to enforce the
24h rule. Only manual triggers can bypass, and only when the operator
explicitly sets the input to true — intended for sync-back / merge
commits whose content has actually been on dev long enough but whose
HEAD timestamp is misleadingly fresh.

Test plan: yaml syntax verified via js-yaml. Functional verification
will be the next manual workflow_dispatch run with the input set.

Co-authored-by: icebear0828 <icebear0828@users.noreply.github.com>