Add exact-target navigation and optional Codex provenance

[codeacme17]

Tracks #1.

Summary

Add exact-target supporting navigation and truthful optional Codex Worktree provenance without making metadata a Git correctness dependency.

Scope

• Worktree actions: Open in Terminal, Reveal in Finder, Copy Absolute Path, Copy Branch/SHA, and reliable Open Task/Open Project where available.
• Changed File actions: Open File in Codex, copy relative/absolute path, Reveal in Finder, and Open in Default App.
• Resolve every native target server-side from opaque IDs and revalidate existence/generation immediately before launch.
• Handle deleted and renamed files using the PRD target rules.
• Add an optional Codex metadata adapter that may associate exact canonical cwd values with task title/status.
• Show Codex task, Scheduled, Permanent, or External only when stable Codex-owned metadata explicitly proves that lifecycle/creator.
• Use Unclassified for missing or conflicting evidence; never infer provenance from path, Branch prefix, or title resemblance.
• Keep Worktree inclusion and Git capabilities identical when the metadata adapter is unavailable.

Acceptance criteria

• Navigation can never open a same-named path in another Worktree.
• Missing/moved targets cancel with explanation plus safe copy/refresh fallback.
• Deleted files cannot Open File; renamed entries target the new path.
• Conflict files may open externally without implying a merge editor.
• Every valid Worktree remains visible and actionable according to Git state when Codex metadata is absent.
• Conflicting provenance evidence produces Unclassified, not a guessed label.
• Host and macOS native actions accept only allow-listed variants and exact opaque targets.

Out of scope

• Worktree lifecycle mutation, task-list badges, opening arbitrary user-supplied paths/URLs, or undocumented private Codex database access.

Dependencies

• Prove the Codex sidebar and standalone Host Adapters #4, Discover registered Worktrees with generation-safe identity #6, Build the adaptive Repository and Worktree overview #8, and Implement truthful change classification and diff review #9.

PRD coverage

• FR2 and FR9; AC-03, AC-22, and AC-23.

Verification

• Host Adapter/navigation contract tests, disappearing-target races, rename/delete fixtures, provenance conflict fixtures, and no-metadata fallback tests.