Add undo, locked branches, remote-only view and script mode

[skunkworker]

Summary

Two commits:

1. Split main.go into git.go, model.go and view.go. An AST script moved the code with no hand edits. Review this commit apart from the second one.
2. Features and fixes. This commit completes the rest of the roadmap in docs/improvements.md.

Safety

• fetch and push run with GIT_TERMINAL_PROMPT=0 and without a terminal, and stop after 60s. A remote that asks for a password cannot freeze the screen.
• The app removes escape codes from commit messages, git errors and raw diffs before it shows them.
• ctrl+c during a delete needs a second press.
• Locked branches: the current branch, a branch in another worktree (+) and a protected branch (P). The default branch and pruner.protect globs are protected.

UX

• u undoes the last delete. When you quit, the app prints restore commands.
• m selects merged branches older than N days. N starts at pruner.staleDays, default 90.
• Rows fit the terminal width. The list height counts the status and error lines.
• The cursor starts on row 1.
• Gone branches with no unique commits no longer show "not merged".
• The app remembers the sort order between runs.
• tab lists remote branches that no local branch tracks. R deletes them. c creates a local branch that tracks one.

Performance

• The list shows before the merge queries finish. The queries run from Init.
• v loads the diff in the background. A resize runs delta again only once, after a short wait.

Script mode

--prune-gone, --merged-older-than DAYS, --fetch, --yes, --dry-run. Nothing is deleted without --yes. Script mode never deletes remote branches.

Behavior changes

• The default branch cannot be selected.
• On the results screen, enter goes back to the list. q quits.

Tests

• 97 tests pass with go test -race. 17 of them are new.
• A fake git on PATH tests the network time limit.

🤖 Generated with Claude Code