fix(run): scope worktree drift to canonical checkout

[solomonneas]

Summary

• evaluate branch and HEAD drift against the canonical lock workspace when a worker runs in an assigned worktree
• retain assigned-worktree snapshots for worker change attribution
• allow worker branch creation and rebases without masking canonical checkout drift
• use isolated worktrees for writable model trials

Root cause

The run guard captured its drift baseline from the assigned worker worktree. A valid worker branch change or rebase therefore looked like operator checkout drift, even though the canonical checkout had not moved.

Verification

• ./scripts/verify: 4646 passed, 3 skipped, 82.93% coverage
• Brigade receipt: 20260728-014639-work-verify-f29f31
• focused regression receipt: 20260728-014033-work-verify-fe0d58

Addresses #597.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: abb9f7a3-1c65-4186-98ca-6f3b73bbe0cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-597-worktree-drift

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}