Users with local long-lived branches were only getting dev/main/master protected after gx setup, which left their active branch unguarded unless they manually ran gx protect add. This change teaches setup to discover local non-agent branches and append missing names to multiagent.protectedBranches while preserving defaults and existing config order.

Constraint: Preserve existing default protected branches and avoid duplicate config entries

Rejected: Only protect the current branch | misses other existing local user branches

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Keep setup-time protection logic aligned with gx protect command semantics

Tested: node --check bin/multiagent-safety.js

Tested: node --test test/install.test.js

Tested: npm test