fix: verify staging remote before write/commit on --push (no dangling commit)

.claude/skills/sync-nowai-leaderboard/sync.mjs

@@ -128,6 +128,18 @@ async function main() {
 
   // 6. Write + commit (apply and push only; never in check mode).
   if (mode !== 'apply' && mode !== 'push') return;
+
+  // For push: verify `origin` is staging BEFORE writing/committing, so a push
+  // from a wrong checkout can't leave a dangling local commit to roll back.
+  if (mode === 'push') {
+    const originUrl = git(root, ['remote', 'get-url', 'origin']).trim();
+    if (!originUrl.includes(STAGING_SLUG)) {
+      console.error(`[sync] refusing to push: origin is not the staging remote (${originUrl}). Nothing written.`);
+      await notify(`Leaderboard sync: push refused — origin is not staging (${originUrl}). Nothing committed.`);
+      process.exit(4);
+    }
+  }
+
   await mkdir(dirname(dataPath), { recursive: true });
   await writeFile(dataPath, JSON.stringify(newData, null, 2) + '\n');
   git(root, ['add', dataPath]);
@@ -136,15 +148,8 @@ async function main() {
   git(root, ['commit', '-m', msg]);
   console.log('[sync] committed.');
 
-  // 7. Push (staging only) if requested.
+  // 7. Push (staging only) if requested. Origin already verified as staging above.
   if (mode === 'push') {
-    // Hard guard: refuse to push unless `origin` is the staging Space.
-    const originUrl = git(root, ['remote', 'get-url', 'origin']).trim();
-    if (!originUrl.includes(STAGING_SLUG)) {
-      console.error(`[sync] refusing to push: origin is not the staging remote (${originUrl}).`);
-      await notify(`Leaderboard sync: push refused — origin is not staging (${originUrl}). Commit kept locally.`);
-      process.exit(4);
-    }
     try {
       git(root, ['push', 'origin', 'HEAD:main']);
       console.log('[sync] pushed to origin (staging).');