# New worktrees branch from canonical instar, not the agent's backup fork

After the last fix, `instar worktree create` correctly accepts an agent's home folder — but the FIRST live use revealed the next layer: the new worktree was branched from the wrong place. The command picks its starting branch from "origin", and on agent machines origin is the agent's personal fork, whose main branch is an automatic backup of the agent's home files — notes, screenshots, memory files — not the instar source code. The resulting worktree had no package.json and no source tree, and the hook-wiring step quietly skipped itself (it bails out when package.json is missing), so the folder LOOKED fine while having zero commit-time checks.

Two changes. First, the repo-trust check now remembers WHICH remote proved trust and HOW: a remote trusted by its fetch address actually mirrors canonical instar, so its main branch becomes the preferred default base for new worktrees; a remote trusted only by its push address proves trust but its local refs are still the fork's, so it is never used as a base. Second — the universal net — the hook-wiring step no longer silently skips when the worktree has no package.json: it now fails loudly with a message that names the likely cause (a fork/backup base) and the two remedies (`--base <canonical>/main` on the command, or the `worktree.defaultBaseBranch` config setting), plus the exact cleanup command. A broken base is now impossible to miss, on every layout.
