fix(ce-compound): isolate learning writes in owned worktrees

[RobertoFZ]

Summary

ce-compound now captures learnings in a clean, task-owned Git worktree, so a capture can run from a shared or dirty checkout without mixing its edits with the user's work. Full and Lightweight captures use the same preflight and guarded write path.

Design decisions

• The helper keys ownership to the source repository and ticket (or source branch/commit), and resumes only a compatible worktree. It rejects dirty, occupied, or redirected paths before writing.
• Session history remains a read-only input from the source checkout. Research and learning edits use the prepared worktree.
• Each product write is drafted outside the destination, checked against its recorded prestate, and atomically replaced. An interrupted write can be retried without silently overwriting a later edit.
• The previous automatic ce-compound-refresh handoff is now a recommendation because it cannot inherit this worktree's write guard.

Fixes #1774. Related to RM-1520.

Validation

• 51 focused tests passed across the worktree helper and existing ce-compound contracts.
• bun run release:validate passed for all 36 skills.
• bun run test: PENDING FINAL RESULT.
• bun run plugin:validate could not run locally because the required claude CLI is unavailable.

Unapplied review findings

• P2, standards (confidence 75): The portable Python interpreter probe in skills/ce-compound/references/worktree-preflight.md uses a compound shell command. A reviewer reads the repo's argv-only shell-tool guidance as applying here. Suggested follow-up: move interpreter selection into a bundled launcher if that interpretation is adopted. Existing skills use the same portable probe, so this change keeps their convention. Review context: ce-rm1520-review-OCFSoaUQ (/tmp/ce-rm1520-review-OCFSoaUQ).

---

Security Disclosure

This adds a local Git worktree and file writer. The helper validates repository ownership, worktree registration, branch, source commit, destination path, symlinks, and file state before replacing an output. It keeps its metadata and worktrees under private directories. Concurrent same-ticket captures are not serialized; a local path can still change between validation and replacement.

Agent Disclosure

• Model: Codex · GPT-6