Discover nested repositories, block unsafe worktrees, and orchestrate confirmed hub sync runs with JSON output and preflight rechecks.