fix(snapshot): isolate indexes from shared object storage

[noamzbr]

Issue for this PR

Closes anomalyco#29413

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Snapshot state kept one persistent Git index per worktree. Sibling sessions therefore serialized through and continuously enlarged the same index; stale index.lock files also broke later captures.

This uses a temporary index per snapshot operation while retaining one shared object database per worktree. Daily refs keep captured trees reachable for seven days, and restore/revert fail without changing the worktree when required objects cannot be read.

Upstream provenance

• Upstream PR #19163 is the inherited baseline for keying snapshot storage by canonical worktree and serializing operations on a snapshot repository. This PR keeps that shared per-worktree object store, but removes its persistent shared index.
• OpenCode v2 snapshot system / PR #33226 supplies the main pattern used here: one snapshot repository per canonical worktree, path-scoped capture, typed restore failures, path-containment checks, and a disposable Git index selected through GIT_INDEX_FILE for preview operations. This PR adapts the disposable-index pattern to capture, restore, and revert so session operations never share index state.
• Upstream PR #31798 supplies the index-seeding performance idea. Upstream copies the source repository index; this PR instead seeds each new scratch index from the previous successful session-scoped capture. Copying the source index directly would import sibling-session paths and recreate the large-index problem.
• Upstream PR #19441 documents the migration failure caused by moving snapshot hashes to a new object store. No migration code is copied: this PR deliberately keeps the existing per-worktree object database, so stored session hashes remain readable while only legacy index files are discarded.
• The daily retention refs/reflogs, six-day index refresh, seven-day expiry contract, and fail-closed object preflight are specific to this PR. They are not copied from upstream v2; they preserve Script.it's existing seven-day snapshot lifetime and ensure a failed restore/revert does not modify the worktree.

How did you verify your code works?

• Focused snapshot and revert suite: 63 passed, 1 skipped
• Concurrent sibling snapshots produce isolated trees while sharing one object database
• Revert/restore failure tests verify the worktree and recovery metadata remain unchanged
• Restored E2B fixture: snapshot tracking was 84 ms cold and 19–27 ms warm

Screenshots / recordings

Not applicable.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[noam-v]

Closing in favor of removing workspace snapshots entirely while preserving message revert semantics. The replacement will be designed and reviewed separately.

[noamzbr]

Closing in favor of removing workspace snapshots entirely while preserving message revert semantics. The replacement will be designed and reviewed separately.