publish-site: name the orphan per run and clean it up

A fixed branch name survived the worktree and collided on the next run, twice.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/publish-site.sh

@@ -1,21 +1,30 @@
 #!/usr/bin/env bash
 # Put dist/ on the `site` branch, which holds build output and nothing else.
 # git-sync follows that branch; there is no image and no rollout.
+#
+# The orphan branch is named per-run and deleted in the trap. A fixed name
+# survives the worktree and collides on the second run, which it did twice.
 set -euo pipefail
 cd "$(dirname "$0")/.."
 [ -d dist ] || { echo "no dist/ — run npm run build first" >&2; exit 1; }
+ROOT=$PWD
 SHA=$(git rev-parse --short HEAD)
+TMP="publish-$$"
 WORK=$(mktemp -d)
-trap 'rm -rf "$WORK"' EXIT
+cleanup() {
+  git -C "$ROOT" worktree remove --force "$WORK" 2>/dev/null || true
+  rm -rf "$WORK"
+  git -C "$ROOT" branch -qD "$TMP" 2>/dev/null || true
+}
+trap cleanup EXIT
 git worktree add -q --detach "$WORK"
 cd "$WORK"
-git checkout -q --orphan publish-tmp
+git checkout -q --orphan "$TMP"
 git rm -rq --cached . 2>/dev/null || true
 find . -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} +
-mkdir dist && cp -R "$OLDPWD/dist/." dist/
+mkdir dist && cp -R "$ROOT/dist/." dist/
 git add -A
 git commit -q -m "site: built from $SHA"
 git push -qf origin HEAD:site
-cd "$OLDPWD"
-git worktree remove --force "$WORK"
+cd "$ROOT"
 echo "published site branch from $SHA"