A request for an unregistered worktree service silently fell back to
another service's first port, masking misconfiguration and risking
routing to the wrong app. Return null for a named-but-absent service
(per the no-silent-fallback routing invariant); only default to the
first port when no service is given. Also validate that port values are
finite positive integers so a malformed instance file can't break
routing with an invalid URL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

worktree destroy skipped the isValidSubdomain guard that create applies,
letting an unvalidated branch flow into {branch} directory substitution
and the post-remove hook cwd (path traversal). Add the guard before any
resolution. Switch git calls to execFileSync to remove the shell, pass
only { worktrees } to writeProjectConfig so a legacy .dev-proxy.json
isn't resurrected, re-read worktrees before writing to narrow the port
TOCTOU window, and prefer the longest matching prefix in findOwningProject.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

doctor read worktreeConfig and routes from readProjectConfig, which only
parses JSON — so for mjs-based projects (now the standard) the value was
always undefined and the entire portRange/services/directory validation
block was silently skipped. Source worktreeConfig and routes from the
resolved ProjectConfig singleton instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

When a request started while detail collection was active but its
request:complete arrived after the 30s idle timeout, the response
headers were dropped and the detail panel showed (awaiting response)
forever. Collect detail when active OR when the id already holds a detail
entry, so an in-flight request's response is merged regardless of idle
state (still bounded by the LRU). Also invalidate the filtered cache
explicitly after in-place eviction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Treat --help/--version as global only in the command position so a
subcommand argument or flag isn't hijacked. Surface a cleanup-failed
status when migrate cannot delete the legacy .dev-proxy.json (it was
swallowed silently, leaving config precedence ambiguous). Reject port
input with trailing garbage in init by parsing with Number instead of
parseInt.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>