feat(map-efficient): per-subtask git worktree isolation (Part of #284)

[azalio]

Part of #284 — Phase 1, Slice 1.

What

Opt-in (worktree.isolation: true), OFF by default, per-subtask git worktree isolation for /map-efficient. Each subtask's Actor runs in a dedicated throwaway git worktree; the result is squash-merged back into the working branch only after the configured verification_checks pass IN the worktree (a pre-merge gate). A rejected attempt (Monitor valid=false / Evaluator fail) is discarded, so the working branch is never touched by a bad attempt.

Why

/map-efficient shares one accumulated session context across all subtasks; #284 is "the second-largest structural gap after spec-driven pipeline". This lands the foundational Phase-1 slice: filesystem isolation + atomic accept/reject + safe rollback (the base Phase 2 parallelism needs).

Design (llm-council-reviewed, conv 461b92f9)

• Runner-owned, not harness-native isolation="worktree" — native hides the worktree path, making deterministic safety gates and explicit merge-back impossible. The two mechanisms must never both be active.
• Accept = git merge --squash + one runner-authored commit (never --no-ff, which would break one-commit-per-subtask).
• Always discard on reject (atomic; retry starts from a clean HEAD).
• Pre-merge verify + crash-safe retry + atomic reject folded in so the slice is not a no-op (council Q5).
• State-root separation (council Q6 blocker): worktrees stored OUT of the working tree under the repo's git common dir; MAP state always resolves against the main checkout; state-mutating commands refuse if invoked from inside a managed worktree.

Step-runner commands (producer-owns-parse; structured {kind,message})

• create_subtask_worktree — crash-safe; guards: not-a-repo, protected-ref, nested-worktree, active-git-op, subtask_id ref/path sanitization, dirty-main (excludes MAP runtime state), submodule init.
• merge_subtask_worktree — base-divergence, runtime-state-in-diff, bulk-deletion (worktree.max_deletions), submodule-pointer, detached-HEAD guards BEFORE touching the working branch, then pre-merge verify, then squash-merge.
• discard_subtask_worktree — atomic reject, idempotent, optional --save-patch.
• worktree_isolation_status — reconcile recorded vs live worktrees.

New worktree manifest stage + .map/<branch>/worktrees.json sidecar. Config keys worktree.{isolation,max_deletions}.

Tests

tests/test_worktree_isolation.py — 30 tests: config (defaults/aliasing/validation/doc), full lifecycle, disabled no-op, and every guard (VERIFY_FAILED leaves main untouched, BULK_DELETION, BASE_DIVERGED, PROTECTED_REF, DIRTY_MAIN + runtime-state exclusion, INVALID_SUBTASK_ID, no_changes detection, crash-safe recreate) against real throwaway git repos.

Gate

Local make check green: ruff + mypy (Success) + pyright (0 errors/0 warnings/0 informations) + 2910 tests passed, 3 skipped + render check (generated trees match templates_src). Single-source render invariant honored (edited .jinja, ran make render-templates; the always-loaded SKILL.md body budget was bumped 508→515 for the irreducible active wiring, full recipe in efficient-reference.md).

Note: GitHub Actions CI is currently unavailable (billing), so this was validated via the local gate.

Deferred (issue stays open)

• Phase 2: wave/DAG parallelism + files_modified overlap detection.
• Phase 3: context-budget hooks (statusline, warnings, heartbeat).