✨ Add create:finish merge front door

The merge half of the branching model was still prose, so it drifted per
session. create:finish mirrors create:branch: it asserts the merge-side
preconditions, fast-forwards a stale main (divergence is refused), merges
--no-ff, runs npm run verify, and deletes the branch only when green. The
push stays with create:release so the merge is reviewable first.

scripts/branch.sh

@@ -31,11 +31,12 @@ set -eu
 # describes nothing anyone wants, and `publish:*` already sets the precedent for
 # a prefix without one.
 #
-# Also rejected: a full git-flow CLI wrapping the merge too (merging ends in
-# "review the diff yourself", which is judgment, and only the start half carries
-# a verification burden); and reusing `pubv`'s preflight (release-shaped,
-# third-party, and it would make branch start pay a build + pack it has no use
-# for).
+# Also rejected here: reusing `pubv`'s preflight (release-shaped, third-party,
+# and it would make branch start pay a build + pack it has no use for). The
+# merge half was originally rejected too ("review the diff yourself" is
+# judgment), but it now has its own front door — `create:finish` — which owns
+# the merge-side preconditions and the post-merge `verify`, so the start half
+# does not have to carry that burden.
 #
 # Every refusal is non-mutating except the baseline test, which runs on `main`
 # after we switch there — so a red `main` restores the branch you started on