Delete remote branches that belong to a merged PR. Destructive, so it runs as a dry-run first and never deletes without explicit confirmation. Delete rule A branch is deletable iff all hold — encoded in , the single source of truth: - it still exists on the remote, - it has a merged PR, - it has no open PR, - it is not protected . Protected = the default branch + . Never delete these, even if a merged PR points at them. A branch with no PR, or only a closed-unmerged PR, is not deletable (it never "belongs to a merged PR"). Extend the protected set in inside , nowhere else. Steps 1. Dry-run. R…