feat(runtime): isolate implementation operators in Git worktrees

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。

[likun666661]

Summary

Follow-up to #1341: make code-changing child operators usable without teaching the graph scheduler about Git.

• add a host-owned SubagentWorktreeExecutor capability and a strict, immutable workspace binding on linked child Sessions;
• provision deterministic per-child Git branches and worktree paths, including same-lease retry/restart adoption;
• persist the binding in SQLite Session metadata and restore it through Session summaries;
• enable the implementation catalog profile only when the host supplies the executor, across Graph, agent_spawn, and Swarm paths;
• wire the real executor into Desktop and expose Write/Edit/Bash only through the implementation profile's existing catalog policy;
• retain terminal child worktrees so Session resume, follow-up, inspection, and patch handoff keep the exact filesystem state.

Two Graph implementation operators now receive distinct worktrees and can edit concurrently. Allocation for one Git common directory is serialized to avoid .git/config lock races; Agent execution remains concurrent.

Safety and boundaries

• The Graph scheduler remains Git-agnostic. Workspace isolation is a host capability consumed during child Session materialization.
• Fresh allocation fails closed for non-Git projects and dirty source worktrees, rather than silently omitting uncommitted parent state.
• Lease, branch, path, common-dir, and base commit are validated on every resume/activation.
• This slice does not merge child branches, delete retained worktrees, or add worktree UI. Those remain explicit lifecycle/product follow-ups.

Validation

• npm run build
• npm run lint -- --diagnostic-level=error
• Core: 1,248 passed
• Storage: 715 passed, 1 skipped
• Runtime focused suites: 326 passed
• Desktop: 2,953 passed
• Headless isolated-tool suite: 54 passed
• Real Git tests cover concurrent A/B isolation, parent cleanliness, retry/restart reuse, dirty-source rejection, and non-Git rejection.

Full Runtime/Headless sweeps also surfaced pre-existing environment-specific failures unrelated to this diff: one macOS executable-root assertion and two Python 3.9 Harbor adapter tests.

中文说明

这是 #1341 的后续能力：让会改代码的 Graph operator 真正拥有独立 worktree，同时不把 Git 逻辑塞进 graph scheduler。

• 新增 host-owned SubagentWorktreeExecutor，并把不可变的 workspace binding 持久化到 child Session 的 SQLite metadata；
• 每个 child 使用确定性的 branch/path/lease，同一次任务重试或进程重启后会复用原 worktree；
• implementation profile 只有在 host 提供 executor 时才可用，Graph、agent_spawn、Swarm 统一走 SessionManager 的能力判断；
• Desktop 已接入真实 Git executor，implementation child 可以使用 Write/Edit/Bash，而其它 profile 仍按 catalog allowlist 收窄；
• child 结束后暂时保留 worktree，因此 Session 恢复、继续追问、观察和 patch handoff 都能看到同一份文件状态。

现在 Graph 中 A/B 两个 implementation operator 会得到不同的 worktree，可以并行改代码。同一 Git 仓库的“分配事务”会短暂串行，以避免 .git/config lock 冲突；Agent 的实际执行仍然并行。

安全边界：非 Git 项目直接失败；父 worktree 有未提交修改时也直接失败，避免 child 静默遗漏用户本地修改。本 PR 不负责自动 merge、自动清理 worktree 或新增 worktree UI。