feat: isolate workflow tasks in managed worktrees

[leynier]

Summary

• Reserve and reconcile workflow-owned integration/task worktrees at exact commits, with fresh retry attempts and durable request/ownership receipts.
• Reuse managed workspace setup off the host actor, retain uncertain/failed resources, and expose bounded local inspection plus Run Board Attention.
• Preserve all workflow dispatch barriers until the integration layer is available.

Validation

• 29 native worktree regressions; full Rust formatting/clippy/workspace tests: 1,414 CLI, 318 core, 191 native tests plus CLI integration suites. Flutter analysis and 57 focused tests pass. One-shot Dart generation, max-lines and whitespace pass; no FRB API change.
• Review 1 found four valid issues; fixed in aad160fb with regression coverage for re-registered resources, symlink roots and 2,000-file setup reports, plus Windows native-build settings.
• Review 2 found two further issues; fixed in 8e7aab92: force branch receipts without changing persistent Git settings and preserve setup diagnostics when later validation fails.
• Review 3 found one further issue; fixed in f5bb5390: stale Git registrations no longer block unrelated workspaces, while ownership and real-error guards remain enforced.
• Review 4 was clean on f5bb5390, but Windows CI exposed a setup shell that could not resolve Git. d84ce8e9 separates Windows test compilation/execution to retain the runner PATH; a real Windows Cargo fixture reproduced the excessive-PATH failure and passed with the new runner. Intentional test/compile failures remain nonzero with diagnostics. Product Rust/Dart source and test expectations are unchanged.
• Review 5 found two valid lifecycle issues, fixed in 87cf7617: non-expiring repository-local ownership receipts and authoritative ownership snapshots that keep generic desktop reconciliation from overwriting or pruning workflow resources. Regression tests cover actual reflog expiry/GC, partial creation, corrupt/foreign receipts, detached or missing checkouts and unchanged identity guards.
• Codex gpt-5.6-sol, high, review 6 against workflows/06-gates (4961d590): clean on 87cf7617, exit 0, no findings. Independently passed 73 focused Rust and 57 Flutter tests on Linux; worktree unchanged and session archived.
• Current-head PR checks, CodeQL, mobile builds and exact-SHA desktop matrix: passed, including coverage, previous-host conformance, Android/iOS and Linux/macOS/Windows native builds and tests. No open CodeQL alerts. Separate full-validation goldens/Linux E2E remain reserved for the final top SHA.
• Current-head Linux typography captures and Run Board captures: all 10 PNGs match the approved parent byte-for-byte, ZIP digests verified; compact filters at 2x also inspected directly.
• Current-head macOS typography captures and Run Board captures: all 10 PNGs verified, ZIP digests matched; six are byte-identical to the parent and four Board captures have small viewport/vertical offsets, inspected directly without new overlap or layout regressions.
• Current-head Windows typography captures and Run Board captures: all 10 PNGs match the approved parent byte-for-byte, ZIP digests verified; compact filters at 2x also inspected directly. All 30 platform captures are verified.
• Desktop attempt 1 passed Linux/macOS, but Windows exceeded the 90-minute job limit during cleanup after passing every test. Windows attempt 2 completed successfully on unchanged 87cf7617: 27 workflow cases (two Unix-only excluded), 13 Flutter integration cases, single-instance CTest and bundle checks. Retry typography and Board images are verified and match the approved references. No source changes or relaxed test expectations. The exact-pair layer gate is closed; the PR stays draft until final stack validation.

Notes

Layer 7 of Orchestration Workflows v1. No visual UI or FRB API change and no automatic cleanup. Project setup remains trusted configuration; Git worktrees are not OS sandboxes. Ownership refs are retained for future explicit reviewed cleanup. Recovery and snapshot behavior is documented in docs/workflow-worktrees.md.