feat(worktree): add automatic cleanup and workspace manager

[bobleer]

Summary

• Add configurable automatic cleanup for old managed worktrees, enabled by default with a per-project limit of 15.
• Add a compact Worktrees settings catalog grouped by owning workspace, with Git state, associated-session summaries, refresh, and deletion controls.
• Limit the management catalog to descendants of the configured BitFun worktree root, excluding unrelated Cursor, Codex, Claude, and other Git worktrees.
• Allow explicit manual deletion without first deleting associated conversations; conversation history remains available while the removed checkout does not.
• Preserve conservative background behavior: automatic cleanup continues to skip every worktree with associated conversations.
• Preserve the complete worktree binding when fresh Task subagents are created and expose explicit worktree identity, owning project root, branch or detached commit, and operating-boundary guidance in Agent context.

Type and Areas

Type:

Feature / UI/UX / reliability / test

Areas:

Rust core, Agent Runtime, desktop/Tauri, web UI, i18n

Motivation / Impact

Managed worktrees can accumulate and consume disk space, while users previously had no central place to inspect or remove them. This adds conservative automatic cleanup after worktree creation and a settings-based management surface.

The catalog now reflects BitFun-owned storage instead of displaying every worktree registered with the same Git repository. Its rows use a compact workspace header, branch and path hierarchy, one-line conversation summary, and icon deletion action so large worktree sets remain scannable.

Manual and automatic deletion intentionally use different policies. A user can explicitly remove a checkout even when conversations reference it; those conversations remain in history, but the deleted checkout is no longer available. Automatic cleanup remains non-destructive and skips any worktree with associated conversations, local changes, unpublished commits, Git locks, missing directories, or non-managed lifecycle policies. New worktrees also receive a 24-hour grace period.

The Agent integration makes the worktree execution target explicit to the parent Agent and ensures fresh Task subagents persist under the owning project with the same execution target.

Verification

• cargo check --workspace
• cargo test -p bitfun-agent-runtime — all tests passed
• cargo test -p bitfun-core service::worktree::tests:: — 18 passed
• cargo test -p bitfun-core fresh_subagent_inherits_matching_parent_worktree_binding
• cargo test -p bitfun-core workspace_context_identifies_the_managed_worktree_binding
• cargo test -p bitfun-core-types worktree -- --nocapture — 4 passed
• cargo test -p bitfun-desktop remote_workspace_policy -- --nocapture — 5 passed
• pnpm run type-check:web
• pnpm run lint:web
• pnpm --dir src/web-ui run test:run src/infrastructure/config/components/WorktreesConfig.test.tsx — 4 passed
• pnpm run i18n:audit — 0 warnings
• node scripts/check-core-boundaries.mjs
• pnpm run theme:color-audit:all
• pnpm run fmt:rs
• Manual visual QA with representative data in dark, light, and 480px-wide layouts; no real worktree was deleted during QA.

Reviewer Notes

• Automatic cleanup runs after a successful managed worktree creation and is best-effort so cleanup failures do not roll back the newly created worktree.
• The workspace catalog returns only worktrees beneath the resolved app.worktrees.rootPath; the desktop command remains LocalOnly for remote-workspace policy.
• Manual deletion removes the checkout and its workspace registration but intentionally leaves associated conversation metadata/history untouched. The confirmation copy explains that the checkout will no longer be available.
• Automatic cleanup still rejects associated conversations, including archived ones.
• Dirty or unpublished work remains removable only through the stronger destructive confirmation path.
• Worktree facts are injected through the portable prompt-facts boundary; platform-specific behavior remains in the existing adapters and services.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.