fix: Fetch remote before merge/push in initiative approval

approveInitiative was merging and pushing with a stale local
defaultBranch, causing "rejected (fetch first)" when origin/main
had advanced since the last project sync. Now fetches remote and
fast-forwards the target branch before merging.

apps/server/execution/orchestrator.ts

@@ -637,7 +637,16 @@ export class ExecutionOrchestrator {
         continue;
       }
 
+      // Fetch remote so local branches are up-to-date before merge/push
+      await this.branchManager.fetchRemote(clonePath);
+
       if (strategy === 'merge_and_push') {
+        // Fast-forward local defaultBranch to match origin before merging
+        try {
+          await this.branchManager.fastForwardBranch(clonePath, project.defaultBranch);
+        } catch (ffErr) {
+          log.warn({ project: project.name, err: (ffErr as Error).message }, 'fast-forward of default branch failed — attempting merge anyway');
+        }
         const result = await this.branchManager.mergeBranch(clonePath, initiative.branch, project.defaultBranch);
         if (!result.success) {
           throw new Error(`Failed to merge ${initiative.branch} into ${project.defaultBranch} for project ${project.name}: ${result.message}`);