run --bg --worktree: isolate background sessions from each other

[Steel-tech]

Background sessions share a working tree. Dispatch three from one repo and all three edit the same files, concurrently, with no coordination.

crates/cli/src/bg.rs has no cwd, worktree, or workspace handling — a detached session inherits whatever directory the dispatching process was in. Sessions record a cwd in the store, so you can see after the fact where one ran, but nothing separates them while they run.

--sandbox does not help here. It confines writes to the workspace; it does not separate agents within one. Three sandboxed agents in one repo are three agents editing the same files.

This is a correctness gap, not a convenience one, and it undercuts the feature bullpen agents exists to showcase: a dashboard cleanly rendering three agents corrupting one tree is a prettier way to watch a failure.

What

bullpen run --bg --worktree creates a git worktree for the session on a run-unique branch, runs there, and records the path in the store.

Opt-in rather than default, so existing --bg behaviour is unchanged. Worth revisiting whether it should become the default for --bg once the cleanup policy has proven itself.

Design questions worth settling before implementing

Cleanup is the hard part, and there is prior art in this org. jig maintains a worktree ledger whose rule is "Retention is fail-closed: uncertainty retains, only remote-ref proof deletes" — a worktree it cannot prove was published stays on disk rather than being cleaned up optimistically. Losing an agent's only copy of its work to an eager cleanup is much worse than leaving a directory behind. Borrow the posture.

Resume across a deleted worktree. bullpen run -r <id> on a session whose worktree is gone needs a defined answer: recreate it from the recorded branch, fail with a clear message, or fall back to the original cwd. Silently running somewhere unexpected is the bad outcome.

Non-repo workspaces. bullpen runs anywhere, not only in git repositories. --worktree outside a repo should fail with a clear message rather than degrading to shared-cwd behaviour, which would be the exact bug this closes.

Discoverability. The path has to surface — in bullpen sessions, in sessions --json, and in the bullpen agents peek panel. An isolated session whose output you cannot locate trades one problem for another.

Prior art

Both live in this org and both solve exactly this:

• jig — dispatches each job into its own worktree, with a Worktrees view and the retention ledger above
• herdr-swarm — "each into its own git worktree on a run-unique branch"

Relationship to #11

Independent. #11 (running bullpen inside jig) would get isolation for free, because jig already dispatches into worktrees. This issue is about bullpen's background mode being safe standalone, without a supervisor above it — which is the posture the architecture claims everywhere else.

[Steel-tech]

Shipped across #14 (the feature) and #15 (four correctness fixes to worktree identity).

bullpen run --bg --worktree gives a background session its own worktree on a run-unique branch under $BULLPEN_HOME/worktrees/<session-id>, records path and branch in the store (schema v6), and surfaces both in sessions, sessions --json, and the agents peek panel — the four things this issue asked to be settled before implementing.

Cleanup is fail-closed by omission: no code path here removes a worktree or deletes a branch. A worktree may hold the only copy of an agent's work, so uncertainty retains and removal stays a deliberate human git worktree remove.

#15 then closed a bug class #14 shipped with: identity was path plus repository, never branch. Four ways something that was not the session's worktree could be accepted — another branch at the same path, a regular file, a dangling symlink, a detached HEAD. All four now report Occupied and name what is in the way. Each guard was mutation-tested.

Worth recording why that mattered: #14 merged with the branch-identity finding still unresolved on its PR. The review had caught it.