feat(worktree): add status + assert-clean read verbs (AB#3086, PR 1a/7)

[PolyphonyRequiem]

PR 1a of 7 in the AB#3085 epic — bare-repo + per-run worktree model. Closes AB#3086.

Why

The current SDLC orchestration's shared-worktree model has caused two recurring production bugs:

1. Launcher hijack — Invoke-PolyphonySdlc.ps1 defaults WorktreeRoot = (Get-Location).Path. When invoked from ~/projects/polyphony, the apex run yanks the operator's main worktree off main onto an impl/{apex}-{item} branch mid-conversation.
2. worktree_dirty cross-contamination — sibling apex runs and ad-hoc operator state on the shared main worktree race each other.

The full epic plan replaces the shared-worktree model with ~/projects/polyphony.git/ (bare) + ~/projects/polyphony/ (operator main, never targeted) + ~/projects/polyphony-runs/apex-{N}/ (plain container) + nested per-branch worktrees. Both production bugs become structurally impossible.

This PR is the keystone: it adds the read-only verbs the launcher (PR 3) and apex driver (PR 4) need to gate dispatch on. Without these verbs first, the rest of the stack cannot land safely.

Surface

Two routing-style verbs (always exit 0; consumers branch on JSON envelope fields):

polyphony worktree status [--path P]

Reports {path, is_clean, current_branch, dirty_paths, error}. --path defaults to the current directory.

polyphony worktree assert-clean [--path P] [--expected-branch B]

Pre-flight gate. Routes on {ok, reason, ...}. Reason values:

Reason	Meaning
null	Assertion passed
path_missing	Path does not exist or is not a directory
not_a_worktree	Git stderr matched "not a git repository"
git_failed	Git status failed for some other reason (locked index, dubious-ownership refusal, permissions, etc.) — distinct remediation from "not a worktree" so the consumer prompts for the right fix
git_operation_in_progress	Paused merge / rebase / cherry-pick / revert / bisect; in_progress_operation field carries which one
dirty	git status --porcelain returned entries; dirty_paths carries them verbatim
wrong_branch	Current branch ≠ expected_branch
internal_error	Verb itself crashed (still exits 0)

Check ordering reflects what the operator must act on first: path → not_a_worktree → git_failed → git_operation_in_progress → dirty → wrong_branch. A paused git operation can leave clean porcelain but is wholly unsafe to dispatch into; dirty fires before wrong_branch because the operator must reconcile dirt before they can switch branches.

Implementation hardening (rubber-duck adoptions)

The rubber-duck pass surfaced one blocker and three meaningful non-blockers; all adopted:

• --no-optional-locks — IGitClient.GetStatusAsync(workingDirectory) invokes git -C wd --no-optional-locks status --porcelain so concurrent gate callers (launcher + driver racing) do not contend on the index lock or rewrite the index timestamp behind the operator's back. These are pure read probes; the caller has explicitly opted out of the index-refresh side effect.
• In-progress detection — IGitClient.GetInProgressOperationAsync(workingDirectory) resolves the per-worktree gitdir via git rev-parse --git-dir, then probes the canonical sentinel paths (rebase-merge/, rebase-apply/, MERGE_HEAD, CHERRY_PICK_HEAD, REVERT_HEAD, BISECT_LOG). This catches the class of bug where status --porcelain reports clean but the worktree is mid-rebase — the exact failure mode of the recurring worktree_dirty incidents.
• Stderr discrimination — assert-clean separates "fatal: not a git repository" (→ not_a_worktree) from "fatal: detected dubious ownership" / "Unable to create '.git/index.lock'" (→ git_failed). The remediation is genuinely different.
• Always exit 0 — every exception path emits an envelope and returns ExitCodes.Success. Non-zero exits would misroute downstream shell scripts before they ever parse stdout.

Sentinel exclusion

VerbHaltOnMissingTheory's auto-discovery treats any empty-string default as a Move-#2 "missing required" sentinel. Status and AssertClean use path = "" / expectedBranch = "" as derive-from-default sentinels (path defaults to cwd; expected-branch defaults to "skip the branch check"). Added an OptionalEmptyStringSentinelZone bucket to opt them out, parallel to the existing Stage4 manifest-path bucket.

Tests

22 new unit tests covering:

• All reason branches in assert-clean (path-missing, not-a-worktree, git-failed × 2 stderr classes, in-progress × 2 operations, dirty, wrong-branch, dirty-precedence-over-wrong-branch, detached-HEAD-with-expected-branch)
• Status verb (path-missing, clean, dirty, detached HEAD, not-a-repo)
• FakeGitClient and StubGitClient stubs in unrelated tests updated to satisfy the new IGitClient overloads

Acceptance

• ✅ Build green
• ✅ All 3217 tests pass
• ✅ CI lint (jinja-resolver, version-drift, prose-children, conductor-validate) green
• ✅ artifacts/verb-output-schemas.json regenerated and matches embedded catalog
• ✅ Two new entries (worktree status, worktree assert-clean) visible in catalog

Stack

PR	Status	Description
PR 1a (this)	this PR	Worktree read verbs (status, assert-clean)
PR 1b	next	Worktree write verbs (init-apex, create)
PR 2	unstarted	Migration script (two-phase Migrate-ToBareRepo.ps1)
PR 3	unstarted	Launcher rework — derives WorktreeRoot from runs dir; refuses main-worktree target; subsumes #302
PR 4	unstarted	Workflow integration + driver pre-flight refusal (combined)
PR 5	unstarted	Concurrency-model ADR (docs/decisions/per-run-worktree-model.md)
PR 6	unstarted	Documentation (onboarding guide + bootstrap skill)
PR 7	unstarted	worktree gc

PR 1b and onward are blocked on this landing.