feat: branch ownership enforcement (S7, #382)

[AndriiPasternak31]

Summary

Enforces the "working branches are per-instance-only" invariant for GitHub-native
agents at four layers, so two agents can no longer silently clobber each other's
state when they end up bound to the same (repo, branch) tuple (the
2026-04-17 alpaca incident).

• Layer 0 — consolidated reservation: single
  reserve_and_generate_instance_id(agent_name, github_repo, ...) helper in
  services/git_service.py that generates a UUID, probes the remote with
  git ls-remote, inserts the agent_git_config row under the new UNIQUE
  index, and retries on either collision up to 5 times. Replaces the three
  ad-hoc generate_instance_id() call sites in crud.py, routers/git.py,
  and the internal initialize_git_in_container path (now deprecated behind
  a warning log).
• Layer 2 — DB uniqueness: partial
  UNIQUE(github_repo, working_branch) WHERE source_mode = 0 on
  agent_git_config. Source-mode agents share branches intentionally, so the
  predicate excludes them. New migration agent_git_config_branch_ownership
  refuses to install the index when pre-existing duplicates are found,
  printing every offending row so an operator can rebind one of them before
  re-running — never auto-deletes.
• Layer 3 — push-time guard: docker/base-image/agent_server/routers/git.py
  now pushes with git push --force-with-lease=<branch>:<expected-sha> where
  the expected SHA is the remote value last observed at fetch (persisted to
  ~/.trinity/last-remote-sha/<branch>). When the lease is rejected we
  return HTTP 409 with X-Conflict-Type: branch_ownership_collision and
  append a structured alert entry to ~/.trinity/operator-queue.json so
  the Operating Room surfaces the collision instead of the agent believing
  its push succeeded.

Closes #382
Refs #381

Test Plan

• bash tests/git-sync/test_p5_branch_ownership.sh — pure-git Tier-1 repro
  demonstrating that --force-with-lease rejects the losing push with
  stale info (exit 1) while the first push succeeds.
• pytest tests/git-sync/test_s7_reserve_instance_id.py -v — 12 unit
  tests covering the helper (retry, max-retries, DB rollback), the partial
  UNIQUE index (source_mode=0 rejects, source_mode=1 allows, cross-repo
  allowed), and the migration pre-flight (detects duplicates, aborts with
  actionable error, installs index on clean DB).
• Manual: stand up two agents on the same GitHub repo and confirm the
  Layer 0 reservation prevents duplicate branch assignment.
• Manual: force a lease mismatch (push from outside Trinity, then sync)
  and confirm a collision card appears in the Operating Room.

Out of scope (deferred to separate issues)

• Frontend GitConflictModal.vue / useGitSync.js updates — Parallel-history detection at modal open (S2) #385/Operator-readable diagnosis modal (S5) #386
• /git/reset-to-main-preserve-state endpoint — Reset-preserve-state operation (S3) #384
• Fleet branch-binding UI tab — separate issue
• get_git_status() ahead/behind tuple expansion — P6

Reviewer notes

• The create_working_branch=True path inside initialize_git_in_container
  is kept for backwards compat but emits a deprecation warning; no in-repo
  callers hit it after this PR.
• The migration fails loudly on pre-existing duplicates by design — per the
  proposal's "Deploy as warnings first, fix duplicates, then flip the
  constraint" rollout plan, operators must resolve duplicates before the
  constraint takes effect.
• Expected conflict with Reset-preserve-state operation (S3) #384 on git_service.py (S3 touches the same file
  for the reset-preserve-state endpoint).

[vybe]

Approved via /validate-pr — 4-layer defense (reserve + ls-remote + partial UNIQUE + force-with-lease) addresses the 2026-04-17 alpaca silent-clobber incident. Tests, rollback paths, and docs all in order.