feat(miner-hands): git-worktree-per-attempt isolation primitive

[JSONbored]

The roadmap's stated concurrency primitive for parallel attempts: each coding-agent attempt runs in its own git worktree so multiple attempts (same or different issues) never collide on a shared working directory. Verified via grep -rln "worktree" scripts/ .github/ — zero hits in either directory, so there is no existing git worktree usage anywhere in this repo's own tooling/scripts/workflows to mirror; this is fully greenfield. The closest existing "isolated execution directory" precedent is isolatedCliCwd() in src/selfhost/ai.ts:450-455, which mkdtemps a plain scratch directory for a review subprocess — useful as a pattern for "always allocate a fresh, cleanup-tracked directory," but not a git worktree and not attempt/repo-scoped the way this primitive needs to be.

Deliverables

• packages/gittensory-engine/src/miner/worktree-allocator.ts (path coordinated with feat(miner-hands): define the CodingAgentDriver interface seam #4262's src/miner/ home) with a pure planning layer — given a repo path, a base branch, and an attempt id, compute the deterministic worktree path/branch name to use — plus a thin injected-exec wrapper (mirroring the SpawnFn injection convention from feat(miner-hands): define the CodingAgentDriver interface seam #4262/feat(miner-hands): CLI-subprocess CodingAgentDriver (reuse SpawnFn/redactSecrets/EFFORT_TIMEOUT_MS pattern) #4266) around the actual git worktree add/git worktree remove calls, so naming/collision logic is unit-testable without shelling out in CI.
• Collision handling: two concurrent attempts on the same repo must never be allocated the same worktree path or branch name — deterministic naming keyed on attempt id, not a random suffix, so a crashed attempt's worktree is identifiable and cleanable after the fact.
• Cleanup/lifecycle: a worktree survives long enough for its attempt's driver run (feat(miner-hands): CLI-subprocess CodingAgentDriver (reuse SpawnFn/redactSecrets/EFFORT_TIMEOUT_MS pattern) #4266/feat(miner-hands): Agent-SDK CodingAgentDriver (query() loop) #4267) to read/write it, and is removed (or explicitly retained on failure for post-mortem) once the attempt concludes — document the retention policy on failure vs. success.
• This primitive is the input the CodingAgentDriver interface (feat(miner-hands): define the CodingAgentDriver interface seam #4262) should accept as its "scoped working directory" — coordinate the exact shape (a path string vs. a richer handle) so it doesn't have to be retrofitted.
• Tests for the pure naming/collision logic (no real git calls) plus at least one integration-style test against a real temp git repo exercising actual git worktree add/remove, gated so it doesn't run unless git is available in the test environment — mirroring how checkDockerPresent (packages/gittensory-miner/lib/laptop-init.js:87-96) treats an optional external tool as "not installed" rather than a hard failure.

References

• Verified via grep -rln "worktree" scripts/ .github/ — zero hits, confirming no existing pattern in this repo's own tooling
• src/selfhost/ai.ts:450-455 (isolatedCliCwd — closest existing "fresh scratch directory per subprocess call" precedent, mkdtemp-based not worktree-based)
• packages/gittensory-engine/src/portfolio/queue.ts:1-27 (PortfolioQueueItem/PortfolioQueue — the concurrent-attempt bookkeeping this primitive's attempt ids should key against, so a queued item and its worktree stay correlated)
• packages/gittensory-miner/lib/laptop-init.js:71-96 (findExecutableOnPath, checkDockerPresent — the "detect an optional external binary, degrade gracefully" pattern this issue's test gating should follow)
• Coordinates with feat(miner-hands): define the CodingAgentDriver interface seam #4262 (this batch) on the exact working-directory input shape CodingAgentDriver accepts

[linear-code]

JSO-3256