fix(worker): block approve of a planning parent with an unfinished child, surface git stderr on ff failure

src/ClaudeDo.Worker/CLAUDE.md

@@ -105,6 +105,9 @@ review. The child row goes `Merged` with `MergeCommit` null (so `revert_merge` o
 whole unit), its worktree and branch are removed, the parent row's `HeadCommit`/`DiffStat` move
 along. A child that can't fast-forward (e.g. started in parallel via Run now) is `Failed` — no
 merge fallback; in the approve path it stays `WaitingForReview` with a `blocked` result.
+A planning parent is only approvable once **every** child is `Done` — `ApproveAndMergeAsync`
+blocks with `subtask X is not Done (status …)`, the orchestrator's rule, so a failed/cancelled child
+never lands half a plan on the target (improvement parents have no such gate, as before).
 `UnitBranchService` never writes task status (it would close a DI cycle through
 `PlanningChainCoordinator`). ⚠️ `QueuePicker` counts `worktrees.state='merged'` as a satisfied
 dependency, so an absorbed child satisfies a `dependsOn` edge although nothing reached `main` yet.