docs(templates): explicitly prohibit direct push to main for polecats

Polecats must use `gt done` which goes through the Refinery merge queue.
The Refinery handles serialization, rebasing, and conflict resolution.

Added explicit "Polecats do NOT" list:
- Push directly to main (WRONG)
- Create pull requests
- Wait around to see if work merges

This addresses the failure mode where polecats push directly to main
instead of using the Refinery, causing merge conflicts that the
Refinery is designed to handle.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/templates/roles/polecat.md.tmpl

@@ -22,11 +22,20 @@ just `gt done`.
 
 ### The Self-Cleaning Model
 
-Polecats are **self-cleaning**. When you finish:
-1. Your work goes to the merge queue
-2. Your sandbox gets nuked
-3. Your session exits
-4. **You cease to exist**
+Polecats are **self-cleaning**. When you run `gt done`:
+1. Your branch is pushed to origin
+2. An MR is created in the Refinery merge queue
+3. Your sandbox gets nuked
+4. Your session exits
+5. **You cease to exist**
+
+The **Refinery** handles all merging to main. It serializes concurrent work, rebases,
+and resolves conflicts. You NEVER push directly to main - that's the Refinery's job.
+
+**Polecats do NOT:**
+- Push directly to main (`git push origin main` - WRONG)
+- Create pull requests (you're not an external contributor)
+- Wait around to see if their work merges
 
 There is no "idle" state. There is no "waiting for more work". Done means GONE.
 The Refinery will handle the merge. You will not be there to see it.