worktrees: provision declared gitignored dependency dirs

[robreyreynolds]

git worktree add starts clean — which is the point, and also the trap: anything gitignored is absent from the new worktree, so a task whose build or check depends on node_modules, a vendored toolchain, or a data cache fails before the worker types a word, and the failure output points at the build rather than at the empty directory that caused it.

New run-level manifest field: worktree_provision — a list of repo-relative paths cloned from the primary checkout into each fresh worktree during taskdir preparation. Copying uses cp -Rc first (an APFS copy-on-write clone, near-instant for a 90k-file node_modules on macOS) with plain cp -R as the portable fallback.

Validation lives where it can fail loudest. Parsing rejects non-string entries, absolute paths (POSIX and Windows forms), .. segments, and the field without worktrees: true or a repo. At provision time, realpath re-proves the source resolves inside the repo (a symlinked entry cannot pull from outside it), a missing source fails taskdir preparation rather than handing the worker a half-provisioned tree, and an existing destination is left alone.

Tests: ten new tests cover the field's parsing and the provisioning behaviour, including the symlink-escape rejection and the existing-destination no-overwrite rule. Full suite matches the baseline on this host — the one pre-existing, unrelated test_deliverables failure reproduces identically with and without this change (same one noted on #85).

Context: this is the first piece of the decomposition plan I posted in #open-brain-skills-engine-ringer, following #85. Pieces 2–3 (a worktree_readonly contract field, then path-containment/fail-loud preparation) build on this one; feedback here will shape how they're carved.