chore: enforce isolated worktrees for feature work

[castrojo]

Problem

The main checkout kept accumulating in-flight work from concurrent sessions. Three defects made that unavoidable:

• .worktrees/ was never gitignored — even though validate-docs.py already excluded it from scanning. A nested .git directory stages as a gitlink and silently corrupts history, which is exactly what AGENTS.md warns about.
• install-hooks.sh resolved hooks via --git-dir — inside a worktree that points at the per-worktree directory, which has no hooks/. The script failed outright.
• A global core.hooksPath silently overrode the repo-local hook — so the origin push guard has never actually run for anyone who sets one.

Changes

.github/scripts/worktree.sh — create, list, retire, and prune worktrees:

bash .github/scripts/worktree.sh new fix/my-thing   # branches from a fresh projectbluefin/testing
bash .github/scripts/worktree.sh list               # worktrees + PR state
bash .github/scripts/worktree.sh done fix/my-thing  # retire one
bash .github/scripts/worktree.sh prune              # retire all merged/closed

Branch retirement is resolved through the forge via gh, because squash merges leave no ancestry for git branch --merged to find.

install-hooks.sh now:

• installs into the common git dir, so it works from any worktree;
• adds a guard refusing feature-branch pushes from the main checkout (SKIP_WORKTREE_GUARD=1 to override);
• when core.hooksPath is overridden, redirects it repo-locally and shims every unmanaged global hook so they keep running. The original path is saved to bluefin.chainedHooksPath so re-runs stay idempotent.

Verification

just check, pre-commit run --all-files, and validate-docs.py all pass. Behavior tested end-to-end:

Case	Result
Feature branch pushed from main checkout	blocked
Same push from a worktree	allowed
SKIP_WORKTREE_GUARD=1 from main checkout	allowed
Push to origin	blocked
new → done round-trip	worktree and branch removed
install-hooks.sh run twice	idempotent, chain preserved

A --show-toplevel bug was caught during testing: it returns the current worktree's root, so it misidentified the main checkout. Now derived from --git-common-dir.

Notes

• Docs land in the same PR per the self-improvement mandate: new docs/skills/worktrees/SKILL.md, plus index and AGENTS.md entries.
• Touches .github/scripts/, not .github/workflows/, so no CODEOWNERS gate.
• Heads up: the global ~/.git-hooks/pre-push on at least one maintainer machine is mode 644, so it is silently skipped. The new hook now warns about this instead of failing quietly.

Assisted-by: Claude Opus 5 via GitHub Copilot CLI