fix(manager): reconcile project assignments with worktrees

[boadij]

Fixes #330

Implements ADR 0019.

Summary

• Reconcile Manager-owned project assignments against a repository-verified git worktree list --porcelain -z inventory at startup, inspection, resume, and worktree-removal event boundaries.
• Fail closed when checkout identity is ambiguous. Missing assignment provenance does not cause branch reassociation to retire a surviving linked checkout; detached worktrees do not block cleanup when a saved checkout path proves they are unrelated; without provenance, any surviving linked checkout remains conservatively ambiguous. Unreadable saved sessions are not treated as evidence of a surviving checkout.
• Retirement revalidates the active Manager, repository/worktree scope, and exact assignment identity under the assignment lock. Ordinary supervision defers on lock contention; native removal-event reconciliation uses bounded, abortable retries.
• Create and verify new checkouts before publishing assignments. Remove pending project messages before the exact assignment. Retire confirmed-missing work instead of reconstructing its worktree during resume_project.

The original Herdr event-callback root cause remains unproven; this change does not attribute the original failure to a specific cause.

External Review #3 follow-up

• Corrected reconcile-assignment-lock so its mocked Git inventory contains no surviving linked checkout and the assignment lock is held before Manager activation.
• The regression confirms the assignment and pending message survive the first Manager inspection while locked, then verifies a subsequent Manager inspection retires the assignment and removes the message after lock release.
• Merged current main (9ee5b397ac9aa0127dcc2f55f4ad79bbb965576e, including docs: establish performance and efficiency principle #335 and refactor(lead): default orchestrators to coordination-only tools #336) without rebasing or force-pushing. Resolved the extension/commands.test.ts overlap by retaining ADR 0019 retirement assertions and the coordination-only Lead defaults/tests from refactor(lead): default orchestrators to coordination-only tools #336. PR remains open and unmerged.

Verification

• npm test -- extension/controller-api.test.ts — passed (111 tests).
• npm test -- extension/commands.test.ts — passed (111 tests).
• npm run validate — passed (907 total; 906 passed, 1 skipped), including build and package audit (66 files).
• Final npm run check — passed (907 total; 906 passed, 1 skipped).
• git diff --check — passed.
• GitHub Actions for final commit cd385e8c3a75e5cebeaddb1f166b4b8335d292cf — passed (run 38005869226): Ubuntu, macOS, and Windows validation; package build/audit; container checks; aggregate CI.
• The branch is mergeable against current main; merge base: 9ee5b397ac9aa0127dcc2f55f4ad79bbb965576e.
• No new live smoke was run: conflict resolution changed tests only; the included main changes are the already-merged PR refactor(lead): default orchestrators to coordination-only tools #336 behavior.

Safeguards and limitations

Reconciliation does not mutate/prune Git worktrees or delete branches or Pi sessions. Historical assignments without trustworthy checkout provenance remain conservatively ambiguous when another linked checkout survives. The native removal smoke recorded earlier in this PR verifies current user-facing cleanup behavior but does not prove the original #330 callback failure mechanism.