fix(refinery): use rig's default_branch instead of hardcoded 'main'

- Add DefaultBranch field to RoleData struct
- Update refinery.md.tmpl to use {{ .DefaultBranch }} template variable
- Populate DefaultBranch from rig config in prime.go and rig/manager.go
- Default to 'main' if not configured
- Add test verifying DefaultBranch rendering in refinery template

Fixes issue where refinery agents merged to master instead of the
configured default branch (e.g., 'develop' or 'develop-cstar').

internal/templates/roles/refinery.md.tmpl

@@ -109,7 +109,7 @@ not by Go code. This follows the Zero Friction Control (ZFC) principle.
 **Example: Handling a Conflict**
 ```bash
 git checkout -b temp origin/polecat/rictus-12345
-git rebase origin/main
+git rebase origin/{{ .DefaultBranch }}
 # If conflict:
 git status                    # See what conflicted
 # DECISION: Can I resolve it? Is it trivial?
@@ -226,7 +226,7 @@ If queue empty, skip to context-check step.
 **process-branch**: Pick next branch, rebase on main
 ```bash
 git checkout -b temp origin/polecat/<worker>
-git rebase origin/main
+git rebase origin/{{ .DefaultBranch }}
 ```
 If conflicts unresolvable: notify polecat, skip to loop-check.
 
@@ -251,9 +251,9 @@ GATE: Cannot proceed to merge without fix OR bead filed
 
 **merge-push**: Merge to main and push immediately
 ```bash
-git checkout main
+git checkout {{ .DefaultBranch }}
 git merge --ff-only temp
-git push origin main
+git push origin {{ .DefaultBranch }}
 git branch -d temp
 git push origin --delete polecat/<worker>
 ```
@@ -340,8 +340,8 @@ gt mail send {{ .RigName }}/<worker> -s "Rebase needed" \
 
 ### Git Operations
 - `git fetch origin` - Fetch all remote branches
-- `git rebase origin/main` - Rebase on current main
-- `git push origin main` - Push merged changes
+- `git rebase origin/{{ .DefaultBranch }}` - Rebase on current main
+- `git push origin {{ .DefaultBranch }}` - Push merged changes
 
 **IMPORTANT**: The merge queue source of truth is `gt mq list {{ .RigName }}`, NOT git branches.
 Do NOT use `git branch -r | grep polecat` or `git ls-remote | grep polecat` to check for work.

internal/templates/templates.go

@@ -29,6 +29,7 @@ type RoleData struct {
 	TownRoot       string   // e.g., "/Users/steve/ai"
 	TownName       string   // e.g., "ai" - the town identifier for session names
 	WorkDir        string   // current working directory
+	DefaultBranch  string   // default branch for merges (e.g., "main", "develop")
 	Polecat        string   // polecat name (for polecat role)
 	Polecats       []string // list of polecats (for witness role)
 	BeadsDir       string   // BEADS_DIR path

internal/templates/templates_test.go

@@ -26,6 +26,7 @@ func TestRenderRole_Mayor(t *testing.T) {
 		TownRoot:      "/test/town",
 		TownName:      "town",
 		WorkDir:       "/test/town",
+		DefaultBranch: "main",
 		MayorSession:  "gt-town-mayor",
 		DeaconSession: "gt-town-deacon",
 	}
@@ -59,6 +60,7 @@ func TestRenderRole_Polecat(t *testing.T) {
 		TownRoot:      "/test/town",
 		TownName:      "town",
 		WorkDir:       "/test/town/myrig/polecats/TestCat",
+		DefaultBranch: "main",
 		Polecat:       "TestCat",
 		MayorSession:  "gt-town-mayor",
 		DeaconSession: "gt-town-deacon",
@@ -92,6 +94,7 @@ func TestRenderRole_Deacon(t *testing.T) {
 		TownRoot:      "/test/town",
 		TownName:      "town",
 		WorkDir:       "/test/town",
+		DefaultBranch: "main",
 		MayorSession:  "gt-town-mayor",
 		DeaconSession: "gt-town-deacon",
 	}
@@ -119,6 +122,53 @@ func TestRenderRole_Deacon(t *testing.T) {
 	}
 }
 
+func TestRenderRole_Refinery_DefaultBranch(t *testing.T) {
+	tmpl, err := New()
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	// Test with custom default branch (e.g., "develop")
+	data := RoleData{
+		Role:          "refinery",
+		RigName:       "myrig",
+		TownRoot:      "/test/town",
+		TownName:      "town",
+		WorkDir:       "/test/town/myrig/refinery/rig",
+		DefaultBranch: "develop",
+		MayorSession:  "gt-town-mayor",
+		DeaconSession: "gt-town-deacon",
+	}
+
+	output, err := tmpl.RenderRole("refinery", data)
+	if err != nil {
+		t.Fatalf("RenderRole() error = %v", err)
+	}
+
+	// Check that the custom default branch is used in git commands
+	if !strings.Contains(output, "origin/develop") {
+		t.Error("output missing 'origin/develop' - DefaultBranch not being used for rebase")
+	}
+	if !strings.Contains(output, "git checkout develop") {
+		t.Error("output missing 'git checkout develop' - DefaultBranch not being used for checkout")
+	}
+	if !strings.Contains(output, "git push origin develop") {
+		t.Error("output missing 'git push origin develop' - DefaultBranch not being used for push")
+	}
+
+	// Verify it does NOT contain hardcoded "main" in git commands
+	// (main may appear in other contexts like "main branch" descriptions, so we check specific patterns)
+	if strings.Contains(output, "git rebase origin/main") {
+		t.Error("output still contains hardcoded 'git rebase origin/main' - should use DefaultBranch")
+	}
+	if strings.Contains(output, "git checkout main") {
+		t.Error("output still contains hardcoded 'git checkout main' - should use DefaultBranch")
+	}
+	if strings.Contains(output, "git push origin main") {
+		t.Error("output still contains hardcoded 'git push origin main' - should use DefaultBranch")
+	}
+}
+
 func TestRenderMessage_Spawn(t *testing.T) {
 	tmpl, err := New()
 	if err != nil {