fix(server): guard worktree lifecycle mutations

[alimek]

Summary

Worktree lifecycle calls could use a hidden registered checkout or return a new path without current source/destination admission. Shared service admission now checks create/remove/prune and PR-thread local/reused/new paths through Git, submodules, setup, refresh and result.

 lifecycle(authority, source)
+  admit actual source and raw/canonical destination owners
+  privately associate one exact server-created path with this operation
   worktree add / reuse / remove / prune
+  recheck current source, scopes and actual path before each protected effect
   setup / durable binding / publication
+  preserve typed denial; admit returned paths after callbacks

Prepare retains write-only local/worktree access; operate is added only for worktree + threadId. Setup cancel checks the actual thread/snapshot path even with no running fiber. Setup terminal open/write recheck after project/settings/crypto awaits. Existing trusted bootstrap/recovery/cleanup remain explicit internal paths; the production ResourceGrantGuard stays closed.

Depends on exact accepted 04c2a source 34141ece213f3176eae6060224c9427377964b47 in #24; base access/04c2-git-mutations. Approved ticket04c2b only. Refs #5, #1.

Evidence

• Before: source audit found lifecycle service methods without explicit authority, same-repository reuse probes before actual worktree ownership, and setup/cancel effects without current destination checks.
  After: 7 focused admission suites /133 pass, including real SQL A/B ownership, native outside-root creation and Deferred cuts before add/submodule/setup/binding/result/cancel. Workspace suite:60 tests. Four existing caller suites:136 pass; native worktree/submodule:21 pass; manager prepare/reuse:20 pass. Counts overlap.
• Named server typecheck and touched19-file lint/format/check pass. Project regression:20 pass; one inherited scope assertion reproduced on exact parent and excluded without a committed skip. Accepted inherited mode-only diff case remains unchanged.
• No repo-wide checks, dev servers, live providers, browser/devices or userdata writes. Full PRService04c3/04c4, durable/background08, MCP09 and clients11–14 remain deferred. Coordinator owns independent source review and client pass.

Merge Danger

Door: two-way

No schema, persisted provenance, dependency or production-gate change. Existing operation-owned rollback and binding-before-publication ordering remain.

Blast Radius: worktrees

More restrictive checks can deny stale/foreign destinations. Native Git effects already completed before a later revocation remain completed; this is T3 resource admission, not an OS/process sandbox.

Model: gpt-6.1-sol. Harness: Codex.

[alimek]

Consolidated into #30 at the same accepted final source tree (b66e06e), now targeting feature/connection-resource-access. Closing this individual stack PR as superseded; its commits, review record and branch remain preserved. No feature activation or main/upstream merge. Tracking issues remain open until integration verification.