`git rebase <base>` is a no-op when HEAD is already a descendant of
<base>, which is the normal shape for a local branch built on top of
origin/main. Without `--force-rebase`, rebase short-circuits, `-S`
never runs, and the unsigned commit gets pushed and rejected by
required_signatures branch rules.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Direct pushes on the canonical branch now target upstream instead of
the personal fork whose branch-protection rules can diverge. Feature
branches still fall back to the fork via remote.pushDefault.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
