[zheng-weihao]

Summary

Replaces the per-branch fetch-refspec machinery (three layers each fixing the previous layer's side effects) with a single wildcard map plus a touchpoint discipline, and turns every git config key orbit depends on into managed state with a three-mode escape hatch.

Core mechanism

• One wildcard map +refs/heads/*:refs/remotes/origin/* written at clone, converged at every fetching touchpoint (sync / info / context --startup / prune) — one predicate per key, no remote comparison, no per-branch bookkeeping.
• Touchpoint fetch discipline: maintain config first, then fetch the default branch plus every tracked branch with one explicit colon refspec each — never a bare fetch (preserves the single-branch economy). A tracked branch the remote lost fails silently (no more couldn't find remote ref leakage); one closing git remote prune origin, gated on the wildcard shape, converges the refs. The default branch is the one loud failure: an ls-remote --exit-code probe tells "remote lost its default branch" (WARNING) from offline (silent).
• Config ownership: three managed keys (remote.origin.fetch, fetch.prune, push.default=upstream), each with a three-mode switch — git.fetchAllBranches / git.fetchPrune / git.pushUpstreamByDefault = always (default) / once / never. Every convergence is reported per key with its escape-hatch command; once/never pools are untouched and unreported. The switches govern config ownership, not ref hygiene — ref cleanup follows the layout shape.
• push.autoSetupRemote handling and the doctor 2.37 soft gate removed; raw mode is plain git. orbit switch -c wires upstream config up front; the first push materializes the tracking ref on the spot. sync --branch writes no fetch config (the wildcard already covers the new default).

Also in this PR

• orbit config key-identity checks (repos.* refusal, branch.prefix validation, the three-mode switches) now compare the lowercased key — git config key names are case-insensitive, so a cased spelling must not bypass its guard.
• Docs restructure: spec-branching → spec-worktree (Root Decision, Config Ownership, Touchpoint Fetch Discipline, Prune's Git Binding, Git Dependency Closure — orbit's git dependencies enumerated as a closed set that only shrinks); spec-lifecycle keeps substrate-independent workspace invariants and points at the binding. Recovery narrative corrected: branch/worktree deletion takes its reflogs with it; the recovery handle is (was <sha>) + objects surviving gc.
• Tests: hermetic git config layers (GIT_CONFIG_GLOBAL/SYSTEM=/dev/null); new coverage for convergence + one-shot quiet, once/never modes, the emptied-config (count=0) shape, the probe tri-state, residue ordering after the sweep, named-only fetch, raw bare push, and the config-key case bypass.

Breaking changes (in CHANGELOG): per-branch fetch refspec reconciliation removed (converges automatically at the next touchpoint); push.autoSetupRemote no longer set (raw-mode users who relied on it: git push -u origin <branch> once).

Test plan

• make test — 341/341 green
• Convergence steering lines verified byte-exact against spec-warnings contract

(The one-time full-fetch step this change introduces on user-run git fetch/git pull stays qualitative in the CHANGELOG by design; quantifying it on giant repos is a release-time measurement, tracked on the 0.2.0 checklist — not a gate for this PR.)