Make project identity host-owned and explicitly shareable

[xai]

Problem

All of a project's persisted data is bound to its identity. That data includes config overrides, network policy, project-scoped secrets and auth, generated tool config, skills, history, memory, and caches. Cleanup operates on the same scope. The identity of a project is currently derived from the directory path, and in one case still from Git metadata.

We should make sure that no repository-controlled data participates in namespace selection at all.

Also, the current approach is too inflexible. Because the identity is strictly one directory, workflows that split a logical project across several checkouts (linked Git worktrees or a bare repository with a collection of worktrees) end up with fragmented config and state per checkout, and there is no convenient way to share project-specific artifacts, such as skills (or, in the future, non-global user extensions).

Concrete example: If I want to provide a project-specific skill for all tools (e.g. claude, codex, pi, ...), I create $HOME/.config/enclave/projects/<path-derived-hash>/skills/<my-project-specific-skill>/SKILL.md. But that skill won't be loaded in a worktree that lives at a different path.

Target invariants

1. Files inside a checkout can influence what gets mounted (required for working with git in worktrees inside the container). But they must never influence which project namespace is selected.
2. Sharing one namespace across several checkouts requires an explicit host-side decision. Enclave must not infer sharing from repository metadata.

Possible solution

My suggestion would be to:

1. Remove Git from identity resolution. Every directory gets an identity derived from its own canonical path, whatever .git contains.
2. Add a host-owned mechanism to enroll related checkouts into one project namespace.