v3.0.1

git-tidy 3.0.1 — round fourteen, and doctor --fix as it should have shipped

3.0.0 went out an hour ago with a way to lose an uncommitted file.

_detached never called _would_clobber_ignored. is_dirty deliberately does
not look at ignored files, so a local .env was invisible to it, and
git switch replaces one the target branch tracks without a word. In a single
run --fix --apply the tool printed sync's refusal of exactly that switch, then
performed it, then summarised it as held back. All four gates now live in
_cannot_leave_a_detached_head, so there is one list of reasons not to move a
HEAD rather than two.

The same function was missing three more of them, each one already written down
somewhere else in the file:

• a bisect: switching resets HEAD, the BISECT_* files survive, and the next
  git bisect good marks the trunk tip. _cannot_switch names this case in its
  own comment.
• a linked worktree, which sync.worktrees: skip exists to leave alone. --fix
  overrode the setting silently and left the worktree holding the trunk, which
  the main checkout could then never be switched onto.
• a trunk that exists only on the remote, reported as "those commits are not in
  main" when they were in origin/main and nothing was at risk.

And elsewhere in --fix:

• Answering q at an --ask prompt threw away the fixes already applied: doctor
  had neither keeping() nor reporting(), though it is now the only other step
  that writes.
• One a consented to all three remedies workspace-wide, because all three used
  kind "fix" — the exact defect consent_key was written for.
• git remote get-url expands insteadOf, so a credential in ~/.gitconfig was
  reported as this repository's and "fixed" by writing the already-clean value
  back, for ever. It reads .git/config directly now, which also means pushurl
  and second url= values are finally looked at — two secrets that had been
  sitting exactly where doctor promises to look.
• https://ghp_abc@github.com/…, the shape every personal access token is
  pasted in, was not recognised at all: the pattern required a colon.
  ssh://git@host still is not a credential.
• "N repositories put right" counted actions, and counted a shared object store
  once per worktree.

Yesterday's tab check scanned the raw line including comments, so
jobs: 4 # workers<TAB>(one per core) loaded from a checkout and refused the
whole config on every shipped binary — the same shape it was written to close.
It looks at the line after the comment and before the trailing whitespace now,
and outside quoted scalars, which is what its docstring always said.

CI: the container runs as root, and root ignores permission bits, so the tests
that chmod something are skipped there rather than failing. Two SC2251 in
release.yml.