feat(worktrees): manage lifecycle on orchestrator v2 - #5589

Problem

Thread worktrees accumulate without a server-owned way to inspect or clean them. The previous cleanup prompt only worked in the desktop client, and a removed worktree could strand the next provider turn.

Solution

• Derive a per-environment inventory from Git and V2 thread projections.
• Protect worktrees with active threads, local changes, unpushed commits, or unavailable status. Revalidate immediately before non-forced removal.
• Apply configurable retention and optional immediate cleanup after the last linked thread is deleted.
• Recreate a missing worktree from its retained branch before provider startup, then restart a per-thread provider session when its working directory changes. An existing worktree is never touched, whatever it has checked out and wherever it lives; sessions shared across threads (Codex) stay open.
• Add a project-grouped Worktrees inventory to Settings → Source Control for every compatible connected environment: one line per worktree (branch, linked thread, last use, sync state, and either Remove or the blockers), two plain settings rows for the cleanup policy, and rows that disappear as soon as removal is confirmed.
• Treat a detached worktree like a branch without an upstream: safe once its commit is on the default branch, otherwise blocked as unmerged. Previously it was marked status-unavailable forever.
• Read the inventory with one git status per worktree, concurrently with the ahead-of-default count, and fetch the per-repository listing, branch sync, and default ref together. On a 2-vCPU environment with 8 worktrees the inventory went from 5.0 s to 0.6 s. Mounting the section no longer issues a duplicate read.
• Keep local branches and checkpoint refs so cleanup remains reversible through automatic revival.

The refresh also removes the unused public revive RPC, fixes provider-start supersession after a mandatory session reopen, parses git worktree list --porcelain -z everywhere (main already requires -z in listRefs), keeps the reaper behind the activation boundary, lets interrupts stop sweeps and status reads, and skips projects outside a Git repository instead of failing the inventory.

Safety

• All worktree mutations share one server-side permit.
• Inventory combines projects that share a Git common directory, including nested project roots.
• Paths are canonicalized, and revival rejects symlink-ancestor escapes outside the managed worktree root.
• Automatic and manual cleanup never force-removes a worktree or deletes its branch.

Screenshots

Light	Dark

Verification

• Targeted typechecks pass for server, contracts, client runtime, and web.
• Targeted lint, formatting, and diff checks pass.
• The isolated worktree dev environment starts and serves the app successfully.
• Added tests were reduced by 669 lines, keeping focused Git, lifecycle, cleanup, revival, and destructive-safety coverage. Later rounds add coverage for detached worktrees, mixed repository and plain-directory projects, and NUL-terminated worktree listings.

Initial implementation and the refresh were produced with GPT-5.6 Sol via Codex in T3 Code. The one-line settings layout, detached-HEAD handling, inventory speed-up, and review follow-ups were done by Claude Fable 5 via Claude Code in T3 Code.
The rebase onto the current orchestrator v2 base, which replaces the base's interim inline worktree repair with the revival service, was done by Claude Fable 5.1 via Claude Code in T3 Code, as were the pre-review fixes that leave existing worktrees alone at turn start and take the mutation permit per worktree.