feat(workspace): support external and detached ephemeral worktrees

[krmcbride]

Summary

Kmux's branch-derived workspace model leaves externally created and detached worktrees outside the normal restore workflow. This change uses Git's registered worktrees as the inventory and records ownership, retention, presentation, and lineage separately. Users can bring an existing checkout into tmux and keep working across branch changes without moving its directory or implicitly changing who may remove it.

Changes

• Restore every live external worktree, including those never previously opened. Add workspace open and close for presentation control. New windows use the configured default launcher; existing windows are reused without restarting it or replaying input. Closing an external window does not exclude its worktree from the next restore.
• Make no-argument workspace create produce a detached ephemeral worktree under the configurable ~/.kmux/worktrees/<random-id>/<repo> root. Optional display names remain independent of storage paths, and lists/windows explicitly identify ephemeral retention.
• Add in-place workspace promote. Promotion preserves the path, workspace ID, checkout, and running panes. Creating, switching, renaming, or publishing branches does not change retention or grant branch-deletion authority.
• Track lineage through stable workspace IDs and commit anchors, including detached workspaces and missing parents. Resolve IDs, paths, labels, branches, and full window names, refusing ambiguous selectors before lifecycle actions.
• Protect advanced or unknown-anchor detached HEAD with a verified recovery ref before owned-worktree removal. Preserve publication branches; only the explicitly owned original persistent branch is eligible for deletion. Dirty worktrees require --force, and recovery failures stop removal.

Compatibility / migration

Supplying a branch to workspace create retains persistent sibling creation and remote-tracking behavior. Existing directories remain in place. No automatic cleanup, relocation, or recovery-ref expiration is introduced.

Missing or version-1 policy state triggers a one-time import of worktrees matching the old strict sibling path and branch-derived basename. These become owned persistent workspaces with their parent links and window names preserved. Later registrations remain external regardless of naming. The first-run ownership boundary warrants review: an externally created worktree matching the legacy pattern is also imported when no prior state exists, while requiring an existing state file would exclude some legacy partial creations.

Validation

• nix develop --command just check passed: formatting, both Clippy configurations, 275 process-free library tests, the Rust workflow suite, 36 adapter contracts, and OpenCode formatting, 47 Bun tests, TypeScript, and bundle checks.
• All five CI checks passed, including Nix package checks on both x86_64 and aarch64 for Linux and macOS.
• Hermetic Git/tmux regressions cover migration and stale registrations, launcher reuse, partial creation, promotion, detached lineage, publication-branch preservation, and recovery recreation. Naming regressions verify legacy primary window/lineage preservation and correct or refused forced-removal targeting under default and custom prefixes. Recovery failure tests cover ref creation, readback verification, and HEAD changes during removal.

No live user-worktree migration or installation was performed. Lifecycle locks coordinate kmux commands; checkout revalidation does not provide an atomic transaction against arbitrary concurrent external Git writers.