♻️ Let create:branch start from an ahead main

`create:finish` leaves the merge local until `create:release` pushes it, so
`main` is routinely ahead of its upstream between a merge and a release. The
branch front door demanded an exact match and refused until it was pushed,
forcing a manual `git push` that the model deliberately keeps out of it.

Reject only a `main` that is behind its upstream — matching `create:finish`,
which already tolerates being ahead — and record why pushing from `finish` was
rejected instead. The push stays with `create:release`, so the merge remains
reviewable locally, and the known issue about the deadlock is gone.

Resolves: backlog task "Resolve the finish/push tension".

CONTRIBUTING.md

@@ -184,9 +184,10 @@ request workflow on Gitea yet.
 - **Branch naming:** `feature/<desc>` / `fix/<desc>` / `chore/<desc>`
 - **Starting work:** `npm run create:branch -- <prefix>/<desc>`. It refuses,
   without changing anything, unless the working tree is clean, no
-  merge/rebase/cherry-pick is in progress, `main` matches its upstream, and
-  `npm run test` is green on `main`. The prefix is _your_ call, inferred from the
-  task; the script validates it rather than guessing it.
+  merge/rebase/cherry-pick is in progress, `main` is not behind its upstream
+  (a local merge not yet pushed is fine — the push belongs to `create:release`),
+  and `npm run test` is green on `main`. The prefix is _your_ call, inferred from
+  the task; the script validates it rather than guessing it.
 - **Merging:** `npm run create:finish` (on the branch). It re-asserts the same
   preconditions, merges `--no-ff`, runs `npm run verify`, and deletes the branch
   only after the merge is green. The push is left to `create:release`, so the
@@ -196,8 +197,7 @@ request workflow on Gitea yet.
 - **Releases are NOT triggered by pushes.** Only the maintainer triggers a
   release; see [Publishing](#publishing).
 
-Full rationale, including the front-door decisions and a known issue about
-`main` being ahead of its upstream between a merge and the next push:
+Full rationale, including the front-door decisions:
 [development/workflow.md § Branching model](./development/workflow.md#branching-model).
 
 ## Submitting changes