fix(worktree): preserve index-hidden changes

[testikun]

Problem

Closes #472. Automatic worktree reclamation trusted git status and non-force git worktree remove to detect local work. assume-unchanged and skip-worktree index flags can hide a modified tracked file, allowing the only copy to be deleted.

Value

A child worktree is preserved whenever its index contains state that can hide local changes. This prevents silent loss of uncommitted work while retaining the existing automatic cleanup behavior for provably clean worktrees.

Approach

• Read a bounded, NUL-delimited git ls-files -v -z inventory before cleanup.
• Preserve the worktree for assume-unchanged, skip-worktree, unknown entries, truncated output, or inspection failure.
• Keep the check read-only: no index flag clearing, reset, clean, checkout, or force removal.
• Add real temporary-Git-repository regression coverage for both flags, clean and modified files, index-byte preservation, unusual paths, and malformed/unavailable inventory.
• Record the design and ablation result in docs/design/WORKTREE_INDEX_SAFETY.md.

Validation

• node --test --experimental-strip-types tests/extensions/shared/worktree.test.ts passed: 37/37.
• bun run check passed: config contract, discipline ledger, Web build/typecheck, format, lint, and TypeScript typecheck.
• bun run test passed: 1476 passed, 1 platform-specific test skipped, 0 failed; Web suite 113/113.
• Ablation: removing the index inventory gate reproduced the reported unsafe cleanup for both hidden index flags, so the gate is required.
• Runtime Pi smoke: not applicable; this is a local Git cleanup invariant.

Impact

• User-visible behavior: worktrees with hidden or uncertain index state remain available for inspection instead of being automatically removed.
• Model-visible context/tools: none.
• Runtime/lifecycle: cleanup gains a fail-closed, read-only index inspection step.
• Persisted config/data: none.
• Compatibility/risk: ordinary clean worktrees and committed work retain existing behavior; Git inventory is bounded to 1 MiB and unusual paths are handled with NUL framing.

[tt-a1i]

结论（对照 1151b75b2f3e9f82df31efad593948bcc4f239ee）

谓词对了：只读 git ls-files -v -z，旗在 / 截断 / 未知 / 读失败 → preserve（removed: false，dirty 保持 undefined）。不是文件字节门，不是 git diff，不是 warn-and-delete。不要改门，不要扩成 checkpoint / 第二套 git OS。

GitHub 今天是 REVIEW_REQUIRED（0 reviews）。对 这个 head 应投 CHANGES_REQUESTED，理由是测试合同和 Windows CI，不是谓词错。

事实

• Head 仍是 1151b75。worktree.ts blob 1a4bfddd。Base a3edee28 的 worktree.ts 与当前 origin/main 0d17f45 同 blob；落后的不是 reclaim 谓词。
• 四种旗 × 改/不改已经锁住 porcelain-empty flagged edit，并且 Windows job 这四条是绿的。changed: false 也 preserve，所以门观察的是 flag，不是字节。
• 缺测： 没有 ls-files -t vs -v 对照（-t 对 assume-unchanged 报 H，与干净 cached 同形）。没有绕过 reclaimWorktree、直接 git worktree remove、断言唯一副本被删的消融（设计文档写了，测试没锁）。
• Windows Background terminals job 101951436807：# fail 7，全是本 PR 新增用例。换行文件名 ENOENT × 1；inventory mock 事后 hello\r\n ≠ hello\n × 6。inventory 路径其实已经 preserve（否则会是 ENOENT）。Linux Node 22/24/26 绿不能当合并证据。
• 本机 git 2.50.1 (Apple Git-155) 独立 fixture 复核：assume-unchanged -v=h / -t=H；两种旗 porcelain 与 git diff 都空；无 --force 的 worktree remove 删掉唯一副本。

建议

1. 同一 fixture 上断言 -t 报 H、-v 报 h，并锁 argv 是 ls-files -v -z。
2. 无 inventory 门时 git worktree remove 必须删掉唯一副本（assume-unchanged 与 skip-worktree 各一次）；看得见的 dirty 必须被 git 拒绝。
3. Windows：unusual path 不要用文件名里的换行；inventory 事后不要写死 "hello\n"。

本地对照（未提交，不替换 #472 实验）：docs/research/EXPERIMENT_487_VS_472_2026-09-09.md。未 pi install，未 merge。