fix: skip merge commits in cherry-pick to prevent fork workflow content loss

External contributors who run `git merge main` create merge commits that
cherry-pick can't handle without -m flag. --no-merges filters these out.
Added detection for branches with only merge commits but real content diff.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/merge.py

@@ -302,12 +302,22 @@ async def _cherry_pick_onto_main(branch: str) -> tuple[bool, str]:
     if rc == 0 and rc2 == 0 and merge_base.strip() == main_sha.strip():
         return True, "already up to date"
 
-    # Get extraction commits (oldest first)
+    # Get extraction commits (oldest first), skip merge commits from fork workflows
     rc, commits_out = await _git(
-        "log", f"origin/main..origin/{branch}", "--format=%H", "--reverse",
+        "log", f"origin/main..origin/{branch}", "--no-merges", "--format=%H", "--reverse",
         timeout=10,
     )
     if rc != 0 or not commits_out.strip():
+        # Check if branch has content but only merge commits (fork workflow edge case)
+        rc_diff, diff_out = await _git(
+            "diff", "--stat", f"origin/main...origin/{branch}", timeout=10,
+        )
+        if rc_diff == 0 and diff_out.strip():
+            db.audit("merge_manual_needed", detail=json.dumps({
+                "pr": pr_number, "branch": branch,
+                "reason": "branch has content diff but only merge commits — needs manual merge",
+            }))
+            return False, f"branch {branch} has only merge commits but contains content — flagged for manual merge"
         return False, f"no commits found on {branch}"
 
     commit_list = [c.strip() for c in commits_out.strip().split("\n") if c.strip()]