fix: Fetch remote before merge/push in initiative approval

approveInitiative was merging and pushing with a stale local
defaultBranch, causing "rejected (fetch first)" when origin/main
had advanced since the last project sync. Now fetches remote and
fast-forwards the target branch before merging.

apps/server/execution/orchestrator.test.ts

@@ -49,6 +49,8 @@ function createMocks() {
     getMergeBase: vi.fn().mockResolvedValue('abc123'),
     pushBranch: vi.fn(),
     checkMergeability: vi.fn().mockResolvedValue({ mergeable: true }),
+    fetchRemote: vi.fn(),
+    fastForwardBranch: vi.fn(),
   };
 
   const phaseRepository = {

apps/server/execution/orchestrator.ts

@@ -637,7 +637,16 @@ export class ExecutionOrchestrator {
         continue;
       }
 
+      // Fetch remote so local branches are up-to-date before merge/push
+      await this.branchManager.fetchRemote(clonePath);
+
       if (strategy === 'merge_and_push') {
+        // Fast-forward local defaultBranch to match origin before merging
+        try {
+          await this.branchManager.fastForwardBranch(clonePath, project.defaultBranch);
+        } catch (ffErr) {
+          log.warn({ project: project.name, err: (ffErr as Error).message }, 'fast-forward of default branch failed — attempting merge anyway');
+        }
         const result = await this.branchManager.mergeBranch(clonePath, initiative.branch, project.defaultBranch);
         if (!result.success) {
           throw new Error(`Failed to merge ${initiative.branch} into ${project.defaultBranch} for project ${project.name}: ${result.message}`);