feat: add task worktree lease lifecycle

[andrei-hasna]

E-00102 — final repair cycle 2/2

Final allowed repair for frozen acceptance scope repos-task-worktree-lease-v1 after exact head b261334b8310071cd344dcc0115af6539171ef33 received two terminal FAIL verdicts. No repair cycle remains after this head; the coordinator owns two fresh exact-head reviews and merge or NO-GO.

Lineage and binding

• Parent native plan: 8eadc06b-7276-4854-a6bc-b879866abf6f
• Parent goal: 32e0d30d-e05a-45ce-9034-dfc9afeefd1d
• Parent node: e7994834-cd3e-4416-80fc-9e82bb8b59e8
• Final repair child goal: 9f72f145-46f4-4868-ab34-bbfba13cdc92
• Todos plan: a08dc545-512f-43ee-a553-6231a2131c50
• Owning task: 7072c9e5-1006-45bb-b0f6-4ecbf08121ff (E-00102)
• Writer generation: 0b30a4ef-654d-441d-bace-481dd0d6729e
• Attempt nonce: 9c37e93f-3262-4727-90fe-cc2c8672f153
• Repair run: 5d5c7682-ee50-4993-91dc-a4357d44f107
• Repair cycle count: 2 of 2
• Terminal reviewer runs on rejected head: 092fb47c-8e43-4e98-b927-e15f908576c2, 66509ad5-76c2-4dce-846c-a198669ead57
• Rejected head: b261334b8310071cd344dcc0115af6539171ef33
• Exact repaired head: 9bdd2b63bcc5f18d4497df5a1a0c2e142a5a2a29

Final repairs

• Cleanup PR policy now consumes an authoritative PR result with the exact PR head SHA. Missing, ambiguous, unreachable, open, stale, or mismatched evidence blocks deletion; gates and receipts expose the exact result additively.
• Interrupted provisioning is reconcilable at reservation-only and filesystem-present points, with or without the reservation receipt. Exact retry is idempotent; explicit recovery fences the old tuple with a fresh generation; identity mismatch becomes durable failure while preserving unique work.
• Cleanup is a recoverable two-phase state machine. Exact passing gates and final head are committed before filesystem removal; deletion is finalized only after the path is absent. Preparation, filesystem, final transaction, and final receipt failures all preserve a deterministic retry route or durable terminal failure without a false cleaned receipt.
• Legacy v12 generation history detects non-consecutive generation reuse. A gen-1 -> gen-2 -> gen-1 ABA sequence is migrated to a durable failed state with explicit evidence while ordinary histories remain monotonic and idempotent.
• Repair-cycle-1 expiry, generation, policy, selector, provisioning receipt, path, symlink, repository identity, clean/upstream/provider, attempt, and machine fences remain enforced.

Exact cumulative changed files

• README.md
• src/cli/index.tsx
• src/cli/task-worktrees.test.ts
• src/db/database.test.ts
• src/db/database.ts
• src/index.ts
• src/lib/task-worktrees.test.ts
• src/lib/task-worktrees.ts

Validation

• Repair-cycle-2 regression red phase: 64 passed, 14 deterministic failures across 78 focused tests.
• Terminal focused lifecycle and database suite: 81 passed, 0 failed, 346 expectations.
• Isolated full suite: 410 passed, 0 failed, 1405 expectations across 31 files.
• Typecheck: passed.
• Build and declaration emit: passed.
• Bun package dry-run: passed.
• Built CLI and built SDK capability smokes: passed.
• Public declaration checks for exact PR results and migration evidence: passed.
• Staged, rejected-head-to-repair-head, and cumulative base-to-repair-head non-printing gitleaks scans: passed.
• Two labeled adversarial self-review passes covered every provisioning and cleanup crash boundary, database and receipt failures, exact PR-head races, ABA histories, retry idempotency, cleanup truthfulness, selector/generation fencing, migration compatibility, and identity/symlink safety. Findings were reconciled before push.

Rollback

Revert exact final repair commit 9bdd2b63bcc5f18d4497df5a1a0c2e142a5a2a29 to return the branch to rejected head b261334b8310071cd344dcc0115af6539171ef33. Migration v13 remains additive; retain generation and failure evidence unless a later explicit migration proves it is no longer required.

Terminal boundary

This is repair cycle 2/2. There is no cycle 3. This PR is not merged, published, released, or deployed by this worker. The coordinator must obtain two fresh final reviewers bound to exact head 9bdd2b63bcc5f18d4497df5a1a0c2e142a5a2a29 and then choose merge or NO-GO.

[andrei-hasna]

Terminal NO-GO — E-00102. Exact failed head 9bdd2b6 did not pass final review after repair cap 2/2 (reviewer runs b5ac1a9d-99a2-4ffe-b7f1-24728443996d and 8dad4298-cdce-47bc-b346-217a922790f5). PR closed unmerged; branch feat/e-00102-task-worktree-leases is retained at the failed head.