Self-heal the recurring core.bare/hooksPath corruption

[vivek7405]

Summary

Closes #166

The main checkout kept landing in a state where every git operation that
needs a work tree failed with fatal: this operation must be run in a work tree, needing a manual git config core.bare false to recover, several
times per session.

Root cause: git's worktree machinery (the review subagents spawn throwaway
worktrees under .claude/worktrees/) can leave core.bare=true in the
shared .git/config. That shared value is harmless only while the main
worktree carries a per-worktree override (extensions.worktreeConfig=true
plus a .git/config.worktree pinning core.bare=false). When the override
is absent, the main checkout reads the shared core.bare=true and breaks.
The old prepare compounded it by writing a relative core.hooksPath to
that same shared surface, so a reset left the framework hook silent and a
stale .git/hooks copy active (the live repo was in exactly this state:
hooksPath pointed at .git/hooks, so .hooks/pre-commit with changelog
generation was not running).

What changed

• scripts/git-worktree-safe.mjs: pins core.bare=false and an absolute
  core.hooksPath on the MAIN worktree, where they survive a shared-config
  flip. Idempotent. Runs from prepare, so every npm install self-heals.
• npm run fix:git heals on demand; npm run check:git asserts the
  invariant and exits non-zero otherwise (regression guard).
• Repo-health note in AGENTS.md (framework-dev section).

Why this shape

A tracked file cannot fix a .git/config problem (the config is not
cloned). The durable answer for a non-tracked surface is a self-healing
prepare step plus an on-demand check, which is what the issue's own
"candidate mitigations" point at. The per-worktree override is preferred
over merely resetting the shared core.bare, because it keeps the main
checkout reading false even if a later worktree event flips the shared
value mid-session.

Test plan

• test/repo-health/git-worktree-safe.test.mjs: simulates the broken
  bare state, proves --check catches it, ensure heals it, and the
  per-worktree override survives a later shared core.bare flip (the event
  that used to re-break the checkout). Idempotency covered.
• npm test full suite: 1522 pass.
• Healed the live repo; npm run check:git passes and the framework
  .hooks/pre-commit (with changelog generation) is active again.

Definition of done

• Tests: Updated (new repo-health regression test).
• AGENTS.md: Updated (framework-dev repo-health subsection).
• Dogfood apps (4): N/A. The change touches dev tooling (scripts/,
  root package.json scripts) only; it does not affect packages/core,
  server, cli, the dist build, the importmap, or anything the apps
  serve.
• Scaffold templates: N/A. This is framework-repo git hygiene; the
  scaffold has its own separate .hooks story.
• Version bump: N/A. No published package changed.

[vivek7405]

Went through the heal script and the regression test. The mechanism itself is sound. I confirmed the per-worktree override keeps the main checkout reading core.bare=false even after a later shared flip, which is the event that used to break things, and that spawning a worktree no longer corrupts the main repo.

Two things worth fixing, both done on this branch:

1. The check:git hooksPath comparison resolved a relative configured value against the current directory, so a drift back to the old relative core.hooksPath slipped past when run from the repo root and only tripped from a subdirectory. Tightened it to require an absolute path and added a cwd-independent counterfactual.
2. Linked worktrees inherit the pinned hooksPath, so a commit inside a throwaway review worktree runs the framework hook. It is harmless (the hook only blocks main and generates a changelog on a version bump), but I documented it so the behavior is not a surprise.

The ensure-mode try/catch is effectively unreachable because every git call uses allowFail. Leaving it as a defensive backstop.

[vivek7405]

Second pass, zoomed in on the revised check logic, the heal ordering, and the fresh-clone path. The check is sound now (an unset hooksPath on a repo with a tracked .hooks correctly reads as broken, topLevel falls back through git-common-dir mid-corruption, and I could not construct a half-healed state that passes the check falsely). One durability gap worth closing, fixed below. The shared test fixture is order-dependent but the drift test re-heals at its end, so it stays green; fine to leave.

[vivek7405]

Third pass over the rfv bump and cross-file consistency. The bump is safe and matches git's native worktree behavior, the counterfactual is genuine (reverting the per-worktree override fails the override-survival test), and the script, test, AGENTS.md, and package.json all agree. One gap: the guard added rfv to ensure but check never validated it, so a drift back to rfv=0 passed check:git. Closed that below.