fix: Roll back merge when push fails in initiative approval

When merge_and_push failed at the push step, the local defaultBranch ref
was left pointing at the merge commit. This made the three-dot diff
(defaultBranch...initiativeBranch) return empty because main already
contained all changes — causing the review tab to show "no changes."

Now mergeBranch returns the previous ref, and approveInitiative restores
it on push failure. Also repaired the corrupted clone state.

apps/server/git/branch-manager.ts

@@ -88,4 +88,10 @@ export interface BranchManager {
    * (i.e. the branches have diverged).
    */
   fastForwardBranch(repoPath: string, branch: string, remote?: string): Promise<void>;
+
+  /**
+   * Force-update a branch ref to point at a specific commit.
+   * Used to roll back a merge when a subsequent push fails.
+   */
+  updateRef(repoPath: string, branch: string, commitHash: string): Promise<void>;
 }

apps/server/git/simple-git-branch-manager.ts

@@ -39,6 +39,9 @@ export class SimpleGitBranchManager implements BranchManager {
     const tempBranch = `cw-merge-${Date.now()}`;
 
     try {
+      // Capture the target branch ref before merge so callers can roll back on push failure
+      const previousRef = (await repoGit.raw(['rev-parse', targetBranch])).trim();
+
       // Create worktree with a temp branch starting at targetBranch's commit
       await repoGit.raw(['worktree', 'add', '-b', tempBranch, tmpPath, targetBranch]);
 
@@ -53,7 +56,7 @@ export class SimpleGitBranchManager implements BranchManager {
         await repoGit.raw(['update-ref', `refs/heads/${targetBranch}`, mergeCommit]);
 
         log.info({ repoPath, sourceBranch, targetBranch }, 'merge completed cleanly');
-        return { success: true, message: `Merged ${sourceBranch} into ${targetBranch}` };
+        return { success: true, message: `Merged ${sourceBranch} into ${targetBranch}`, previousRef };
       } catch (mergeErr) {
         // Check for merge conflicts
         const status = await wtGit.status();
@@ -208,4 +211,10 @@ export class SimpleGitBranchManager implements BranchManager {
     await git.raw(['merge', '--ff-only', remoteBranch, branch]);
     log.info({ repoPath, branch, remoteBranch }, 'fast-forwarded branch');
   }
+
+  async updateRef(repoPath: string, branch: string, commitHash: string): Promise<void> {
+    const git = simpleGit(repoPath);
+    await git.raw(['update-ref', `refs/heads/${branch}`, commitHash]);
+    log.info({ repoPath, branch, commitHash: commitHash.slice(0, 7) }, 'branch ref updated');
+  }
 }

apps/server/git/types.ts

@@ -56,6 +56,8 @@ export interface MergeResult {
   conflicts?: string[];
   /** Human-readable message describing the result */
   message: string;
+  /** The target branch's commit hash before the merge (for rollback on push failure) */
+  previousRef?: string;
 }
 
 // =============================================================================