Run one auth fix in a named worktree

Review .cursor/worktrees.json before creation because its setup commands run in each new checkout. From acme-api, start a named auth-fix worktree and state the package and test boundary. Confirm the reported repository root, branch and starting commit. Keep sandboxing enabled and allow only the network host the dependency or test needs. Put repeatable command rules in .cursor/cli.json. Reject a global sudo install because the repository can use a local dependency. Then inspect the final diff, rerun the auth test and push the worktree branch for a pull request. The main checkout should remain unchanged.