feat: add lease-backed worktree control plane

[andrei-hasna]

Summary

• add atomic lease-backed claim, inspect, verify, renew, release, inventory, and import operations for task worktrees
• expose the control plane through the CLI, SDK, and seven MCP tools with positive-safe-integer fencing inputs and nonempty required identity/path schemas
• reconcile worktree lineage with current registry, branch-adjudication, and relocation schemas through unified migration v21
• prove the complete migrations ledger after marker triggers, verify external-content FTS integrity, and preserve chronological non-colliding legacy ownership keepers with exact demotion receipts
• derive omitted bases from the canonical live default while persisting explicit-versus-derived provenance across all idempotent retry paths
• enforce one canonical Git object-ID contract: exactly 40 or 64 lowercase hexadecimal characters, with NULL-total terminal proof and ownership predicates
• serialize direct quarantine compensation retries with the same per-lease operation lock while avoiding reentrant locking
• hold common and per-worktree Git configuration locks through claim/import activation and release/quarantine finalization, then revalidate origin identity and transport under lock
• document lifecycle, recovery, quarantine, import, and migration behavior

Todo: fed786c6-6276-43b1-8b1a-cc8b8034ae0c
Goal: 1dc78145-4323-49be-9674-6d1dde974ac4

Verification

• bun run typecheck
• focused TMPDIR=/dev/shm bun test ... — 239 pass, 0 fail, 1265 assertions
• TMPDIR=/dev/shm bun test — 483 pass, 0 fail, 1973 assertions
• bun run build
• git diff --check
• gitleaks git --staged --no-banner --redact
• gitleaks git --log-opts=origin/main..HEAD --no-banner --redact

TMPDIR=/dev/shm avoids station01 pre-existing /tmp/.git, which correctly makes default-temp inventory fixtures appear as nested Git checkouts.

Earlier heads 6a4b97e, e39d921, 6eb22d8, and 6ff0929 were independently rejected and are superseded by current exact head 3c2541b908763a71a61e5db9c65de1ee30d59321; their review evidence is invalid. Hosted CI and two fresh independent exact-head PASS verdicts are required before implementation handoff. This PR must not be merged by the implementation session.