scripts: prefer the forge remote over alphabetical order when picking check-attribution-trailers.sh's base ref

scripts/check-attribution-trailers.sh

@@ -24,10 +24,15 @@ branch="${GITHUB_BASE_REF:-main}"
 # unresolvable, and unresolvable, in the old code, silently read as clean
 # (fetch-or-`true`, then a fallback to `HEAD~10`) — that fail-open was the
 # actual bug. So: try `BASE_REF` if the caller set one, then every
-# configured remote in a stable order (an `origin` remote first, to match
-# CI, then the rest alphabetically), fetching a remote's copy of `branch`
-# if it isn't already present locally. If none of that resolves a base,
-# exit 1 with a clear message — never guess a commit range.
+# configured remote in a stable order (`origin` first to match CI, `forge`
+# second since that's the hive's own upstream name, then the rest
+# alphabetically), fetching a remote's copy of `branch` if it isn't already
+# present locally. The explicit `forge` priority matters because an agent
+# worktree with a personal fork remote (e.g. `damocles-fork`) would
+# otherwise hit that fork first — it sorts before `forge` alphabetically —
+# and a stale or archived fork resolves to the wrong base, flagging
+# already-merged commits as new violations. If none of that resolves a
+# base, exit 1 with a clear message — never guess a commit range.
 base=""
 if [ -n "${BASE_REF:-}" ]; then
   if git rev-parse --verify "$BASE_REF" >/dev/null 2>&1; then
@@ -42,8 +47,12 @@ else
   if printf '%s\n' "$remotes" | grep -qx origin; then
     ordered_remotes="origin"
   fi
+  if printf '%s\n' "$remotes" | grep -qx forge; then
+    ordered_remotes="${ordered_remotes:+$ordered_remotes }forge"
+  fi
   for r in $(printf '%s\n' "$remotes" | sort); do
     [ "$r" = "origin" ] && continue
+    [ "$r" = "forge" ] && continue
     ordered_remotes="${ordered_remotes:+$ordered_remotes }$r"
   done