Define the session anchor as the HEAD revision captured at run start (a
fixed sha), not the live `main` ref, and spell out the git-worktree case:
the run sits on its own branch, so a reset to the anchor only moves that
branch and cannot reach `main`. Keeps the wording correct when the run is
not on `main`. Also rephrase the veto case from "committed on `main`" to
"committed below the session anchor (ratified history)".
closes#16
Brummel
eec4754c3c