mac-bridge client: refuse dirty trees; =-joined branch-policy args

Live testing caught both: a leading-dash branch suffix (-b876) was
parsed as an option flag, and request_run's 'git add -A' silently
absorbed unrelated uncommitted edits into the request branch (they
vanished from the original branch on switch-back). Requests are now
always built from a committed state.

Co-authored-by: FluffyAIcode <FluffyAIcode@users.noreply.github.com>

Author: cursoragent

scripts/mac_bridge/kakeya_mac.py

@@ -53,8 +53,10 @@ def _branch_policy_args() -> list:
     if not match:
         return []
     suffix = match.group(1)
-    return ["--branch-prefix", "AgentMemory/mac-bridge-",
-            "--branch-suffix", suffix]
+    # `=`-joined so argparse never mistakes a leading-dash suffix
+    # (e.g. "-b876") for an option flag.
+    return ["--branch-prefix=AgentMemory/mac-bridge-",
+            f"--branch-suffix={suffix}"]
 
 
 def cmd_doctor(_args) -> int:

scripts/mac_bridge/request_run.py

@@ -120,6 +120,17 @@ def main() -> int:
     repo_root = Path(_git("rev-parse", "--show-toplevel", capture=True))
     original_branch = _git("rev-parse", "--abbrev-ref", "HEAD", capture=True)
 
+    # Refuse to build a request from a dirty tree: `git add -A` below
+    # would silently absorb unrelated uncommitted edits into the
+    # request branch and they would vanish from the original branch
+    # when we switch back (observed in live testing). The workload is
+    # always a committed state.
+    dirty = _git("status", "--porcelain", capture=True)
+    if dirty:
+        print("[mac-bridge] working tree is dirty; commit or stash first:\n"
+              + dirty, file=sys.stderr)
+        return 2
+
     # Snapshot bridge files from the CLIENT checkout before switching:
     # the workload ref may predate the bridge.
     overlay = {