♻️ Let create:branch start from an ahead main

`create:finish` leaves the merge local until `create:release` pushes it, so
`main` is routinely ahead of its upstream between a merge and a release. The
branch front door demanded an exact match and refused until it was pushed,
forcing a manual `git push` that the model deliberately keeps out of it.

Reject only a `main` that is behind its upstream — matching `create:finish`,
which already tolerates being ahead — and record why pushing from `finish` was
rejected instead. The push stays with `create:release`, so the merge remains
reviewable locally, and the known issue about the deadlock is gone.

Resolves: backlog task "Resolve the finish/push tension".

development/workflow.md

@@ -26,7 +26,10 @@ plus hand-written `git`.
   gate is not paid on an ineligible tree.
 - The merge half owns the post-merge `npm run verify`, so a merge cannot land
   unverified. The push stays with `create:release` so the merge is reviewed
-  locally first.
+  locally first; `main` is therefore routinely ahead of its upstream between a
+  merge and the release that ships it. `create:branch` requires only that `main`
+  is not _behind_ — matching `create:finish`, which tolerates the local merge and
+  fast-forwards over a remote one — rather than an exact match.
 - Every failure is non-mutating except the baseline test, which runs on `main`
   after switching there: a red `main` restores the branch you started on, and a
   merge conflict aborts back to the feature branch rather than stranding a
@@ -42,12 +45,9 @@ plus hand-written `git`.
   can run from a dirty tree.
 - Fast-forward instead of `--no-ff`: `--no-ff` keeps each unit of work visible
   in `git log`.
-
-#### Known issue
-
-- `create:finish` does not push, so `main` is ahead of `origin/main` between a
-  merge and the next push. `create:branch` requires `main` to match its upstream
-  and refuses until it is pushed; push `main` before starting the next branch.
+- Pushing from `create:finish` to keep `main` level with its upstream: it would
+  trade the local review the push waits for for a network side effect, and a
+  failed push would leave the merge landed but unpublished.
 
 ## Changelog notes