test: prove safe prepared-workspace claiming

[nicksenap]

Summary

• add a test-only executable spike for anonymous detached worktree preparation and claiming
• compare workspace-root relocation plus git worktree repair against an immutable backing path exposed through a named symlink
• prove the stable-path strategy preserves Bun-style and Python-style prepared dependencies while relocation breaks absolute Python virtualenv launchers
• prove state-last visibility, exact-SHA/branch/worktree ownership checks, operation-level rollback, uncertain-state fail-closed behavior, and cross-store claim/discard serialization
• prove ownership-aware deletion rejects dangling aliases, retargeted aliases, replaced worktrees, and unexpected valid repositories added to state
• document the selected strategy and the concrete ownership, lifecycle, reconciliation, diagnostics, and cleanup requirements for Add an opt-in local Oven #78

Result

GO for #78 with a stable immutable backing path and named workspace symlink.

Relocating prepared roots is a no-go: Git can be repaired, and relative Bun-style links survive, but absolute Python virtualenv launchers do not. A stable backing path preserved both toolchains in committed POSIX probes and in an ignored local multi-language monorepo test using its real Bun and Python package managers.

This PR intentionally adds no public command, Oven pool, production state schema, scheduler, generic transaction framework, or cache.

Safety evidence

The spike covers:

• detached worktrees at recorded commit SHAs
• trusted inventory, source allowlisting, safe unique names, and strict path containment
• state written only after branch attachment and alias publication
• first/second branch-assignment failures
• alias publication failures and external path races
• failed and committed-but-error state writes
• state-removal uncertainty preserving all claim artifacts
• claim versus claim/discard serialization using separate state stores
• preflight ownership, commit, tracked-file, target-path, and branch tampering
• exact state-versus-claimed-record matching before ordinary deletion
• parsed Service.Status --json assertions through the healthy alias
• dangling, retargeted, replaced, and extra-repository destructive-operation refusal
• normal post-claim commits and verified backing-root cleanup

Hard process termination, partial discard, and same-user filesystem races are explicitly documented as #78 quarantine/reconciliation requirements.

Verification

• PATH="$(go env GOPATH)/bin:$PATH" just check
• go test -race ./internal/workspace -run PreparedClaimSpike -count=1
• independent race repetitions and adversarial code/security review: PASS
• final claim-strategy attestation: PASS / GO
• just e2e — 128/128 passed
• ignored private validation passed without committing identifiers or fixtures
• git diff --check

Closes #77