repo-status.sh derives up_to_date_with_main from the local origin/<main>
ref without fetching, so a stale snapshot could mark a repo "up to date"
when its origin had actually moved. sync would then report "all up to
date" and skip a needed rebase; finish would pass pre-flight and only
discover the staleness mid-merge.
Both skills now run `for-each-repo.sh fetch origin` as a mandatory first
step before the snapshot. Dropped the redundant per-repo fetch from sync's
execute step; kept finish's `pull --ff-only` as defense-in-depth.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
