[vanvasten]

What this does

/ship now pushes with whatever GitHub login actually works on the machine, never pushes straight to main, and always files the Linear ticket in the repo's own team and project. It fixes a real session on mesinyer that went hunting for 1Password, kept retrying SSH with no key loaded, and merged a fix to main with no ticket and no PR.

Fixes OSS-96.

Summary

Review order: start with src/lib/git-transport.ts, then src/hooks/safety-net.ts, then skills/ship/SKILL.md. The rest is docs, evals and manifests.

• Git push: startup line (src/lib/git-transport.ts, src/scripts/git-transport.ts, src/scripts/session-start.ts): says SSH when an agent has a key loaded. Otherwise it gives the exact gh-login push command, a per-command -c override with no saved password, plain HTTPS remote or global insteadOf. With neither login it says "not logged in". The line covers every push in the session, not only /ship. 1Password is named only when it is installed.
• safety-net (checkMainPush): a push to main/master, --all, --mirror, or a bare push while on main goes through the permission prompt. Branch deletion and force pushes are left to the org rulesets, which already block them on every repo.
• /ship: the preflight reads the Git push: and Linear: lines. It stops when Linear is not connected, branches off main as <type>/<ID>-<slug> before committing, and pushes with the detected command. The Linear step resolves the team from ~/.claude/linear-teams.json, then the startup Linear: line, then the shared map, and never invents a placeholder ID.
• Manifests: Claude v40 and Codex runtime v28 add the two git-transport files on top of the versions main added since this branch started.
• Version 15.97.0. The CHANGELOG entry also releases the [Unreleased] worktree-cleanup note already on main.

Test Plan

• bun run typecheck, lint, lint:skills, lint:links, audit:hooks: all clean.
• bun run test: 3180 pass, 8 fail. All 8 also fail on this machine without the change: npm-installer x3 (broken asdf shim), safety-net removed-cwd x3 (Bun 1.3.14), Codex TOML x1, and runtime-dependencies, which passes when run alone (timeout under parallel load).
• End to end in a scratch clone of mesinyer whose push URL pointed at a local bare repo, with no SSH key loaded: "ship it" from main created the Linear issue in team Darkroom Incubator, project Mesinyer (the earlier run invented DR-000). It branched to docs/INC-484-readme-placeholder, committed there, pushed only that branch, and left main untouched. The test issue was then canceled.
• ci-gate green: all 11 checks pass.