* fix(hooks): approve setup from the ref a new workspace checks out
The setup trust check before a create read orca.yaml from the project's
own checkout, while the host (since #37977) checks the created worktree.
A checkout behind origin/main made every create skip setup and open the
"branch has different setup commands" dialog right after creation.
The check now reads orca.yaml at the ref the create checks out (the
resolved base, or the local branch for explicit reuse), refreshing it
only when create would, under one deadline. Any failure falls back to
the previous checkout read, and older hosts ignore the new parameter.
* fix(hooks): stop optional setup reads at the deadline and cover automation recovery, VM and web paths
* fix(hooks): refuse late WSL git retries and approve an automation's saved base on recovery
* docs(hooks): move the skipped-setup recovery comment back to its function
* fix(automations): re-approve setup when an automation's base branch changes
Brennan Benson
Neil