feat: branch audit sprint — ai_mail 95%, backup 93%, seedgo checker overhaul

AI Mail (91% → 95%):
- Fixed 72 silent catches across 18 files
- Fixed help_text python3 refs in branch_ping.py
- Removed 4 dead functions
- Added 11 deep nesting bypass entries (13 justified functions)

Backup (91% → 93%):
- Fixed 49 silent catches across 12 files
- Added 6 deep nesting bypass entries (4 justified + 2 skip for google sync rewrite)

Seedgo:
- Full checker overhaul — 10 new content files + markdown docs for integrated checkers
- Removed obsolete files (bypass_content, aipass_bypass, aipass_ignore, python/typescript diagnostics, file_handler)
- Updated all 34 checker files with improved scoring and detection
- bypass.json expanded with self-audit entries

Also includes: drone test updates, flow template changes, global prompt updates.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/aipass/drone/tests/test_git_module.py

@@ -470,13 +470,11 @@ class TestPRHandler:
         assert "nothing to commit" in result["message"].lower()
 
     def test_cleanup_always_runs(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        """Checkout main and release lock happen even on errors."""
+        """Release lock happens even on errors (never leaves main)."""
         registry = tmp_path / "AIPASS_REGISTRY.json"
         registry.write_text("{}", encoding="utf-8")
         monkeypatch.chdir(tmp_path)
 
-        cleanup_calls = []
-
         def mock_subprocess_run(cmd, **kwargs):
             result = MagicMock()
             result.stderr = ""
@@ -485,14 +483,10 @@ class TestPRHandler:
             if cmd[1:3] == ["rev-parse", "--abbrev-ref"]:
                 result.returncode = 0
                 result.stdout = "main\n"
-            elif cmd[1:3] == ["checkout", "-b"]:
-                result.returncode = 1
-                result.stderr = "fatal: branch already exists"
-            elif cmd[1] == "checkout" and len(cmd) > 2 and cmd[2] == "main":
-                cleanup_calls.append("checkout_main")
+            elif cmd[0] == "git" and cmd[1] == "add":
                 result.returncode = 0
-            elif cmd[1] == "pull":
-                cleanup_calls.append("pull")
+            elif cmd[1:3] == ["diff", "--cached"]:
+                # Nothing staged — triggers early exit
                 result.returncode = 0
             else:
                 result.returncode = 0
@@ -509,7 +503,7 @@ class TestPRHandler:
                     result = create_pr("api", "test desc", tmp_path / "src" / "aipass" / "api")
 
         assert result["success"] is False
-        assert "checkout_main" in cleanup_calls
+        # Lock must always be released, even on early exit
         release_mock.assert_called_once_with(force=True)