build: pnpm build should refuse to run when local main is behind origin/main

[waleedkadous]

Problem

`pnpm build` builds whatever is in the working tree. If the architect forgets to `git pull` after a builder merges a PR, the build silently produces stale artifacts. The downstream `local-install` then ships old code while reporting success.

This bit us during v3.0.0-rc.12 testing on 2026-04-25 — PR #701 had been merged on origin/main but `local main` was still at the v3.0.0-rc.12 tag, so the rebuilt dashboard didn't have the assignee changes from #700.

Proposal

Add a pre-build check (in the root `package.json` build script, or as a guard in `scripts/local-install.sh`) that fails fast when:

• The current branch is `main` AND
• `origin/main` is ahead of `HEAD`

The check should:

1. Run `git fetch --quiet origin main`
2. Compare `HEAD` with `origin/main`
3. If origin is ahead, print: `local main is N commits behind origin/main — run 'git pull' before building` and exit 1.
4. Override flag for unusual cases: `SKIP_GIT_FRESHNESS_CHECK=1 pnpm build`.

Acceptance

• Forgetting to pull before `pnpm build` on a stale main fails with a clear error.
• The check is silent when local is up-to-date or ahead.
• Other branches (worktrees, builder branches, release branches) are unaffected.

Out of scope

• Don't enforce on builder worktrees — they branch from a known commit.
• Don't try to auto-pull — fail and let the human decide.