Discover registered Worktrees with generation-safe identity

[codeacme17]

Closes #6.

Dependency state

Blocked on #5. Keep this PR in draft and do not merge until the protocol and security issue is closed.

Summary

• resolve the Current Project through system Git to its canonical common Git directory
• use git worktree list --porcelain -z as the authoritative Main and linked Worktree inventory
• preserve raw path bytes while exposing safe display paths and canonical UTF-8 paths when available
• classify attached, detached, Initial, locked, missing, prunable, broken, and redirected registrations truthfully
• issue opaque Repository and Worktree generation identities and invalidate them across replacement, removal, recreation, and movement
• fail closed on Repository replacement, Worktree admin redirection, duplicate admin identities, and close-versus-snapshot races
• sanitize inherited Git environment variables and keep Git process construction inside Repository Engine

Scope

This PR implements Repository and Worktree discovery through the Repository Session seam. It does not add status refresh, watchers, mutation lanes, or protocol endpoint wiring.

Out of scope

• refresh scheduling, subscriptions, process cancellation, mutation lanes, and reconciliation: Implement versioned refresh, operation lanes, and reconciliation #7
• adaptive production UI integration: Build the adaptive Repository and Worktree overview #8
• status, diff, Branch, Remote, and mutation behavior: Implement versioned refresh, operation lanes, and reconciliation #7 through Add exact-target navigation and optional Codex provenance #15

No known pre-existing defects were found in the touched discovery paths.

Verification

• 87 tests across 20 test files
• 20 focused Repository discovery and parser tests using real temporary Git repositories
• npm run typecheck
• npm run lint
• npm run build
• npm run format:check
• independent Standards and Spec reviews: no findings

PR preflight was skipped at user request.