fix(trail): fail closed when the bare-number update guard cannot check the branch

The guard refused only when it positively found the branch's work on another trail; every indeterminate path let the update through. Overwriting another owner's trail is the worst outcome, so it now refuses, naming the ULID rerun, when it cannot establish the branch's trail:

• a lookup error or a lookup exceeding 10s (sanitized one-line error shown)
• work returned without a project parent
• a branch scan stopped at trailFindMaxPages with a cursor left (new scanTrailPages reports completeness; findTrailAtPath keeps its contract)
• a detached HEAD in a clone of a project repository (also suggests --branch)

--repo no longer disables the guard: naming the clone's own repository keeps it, naming another repository skips it. Suggested commands now say to rerun with only the selector changed, so the user's update flags carry over.