Rebuild the agent-worktree sweep on the decided unit

[blooop]

Work

Rebuild the agent-worktree sweep on the unit the keystone ticket decided, and on the safety predicate its ticket decided, so that the two surviving defects on PR #442 have no representation rather than a guard each.

Blocked deliberately: the whole lesson of the parked single-ticket map is that building before these are settled produces a correct fix per instance and the same shape again.

Scope:

• Implement the decided unit and the decided predicate. Where the answer says a state should be unrepresentable, the test for it asserts the absence of a path, not a guard firing.
• Close T1: a worktree nested inside one that is being removed. Three probes exist on the second review report and become tests: nested holding an uncommitted note, nested holding an unpushed commit, and nested git worktree locked. The locked case is dl --prune cannot reclaim agent worktrees inside live workspaces' clones (104 GB measured) #426's Ask 2 and must be impossible to lose.
• Close T2: a registration created after the plan was printed. The gate's domain and the metadata prune's blast radius must be the same thing, or the prune must become per-registration if the git research says that is available.
• Carry over what the first build got right rather than rewriting it: the four-way classification, the MetadataGate fold (S1 is genuinely closed and reproduced), the container-path-aware dirty check, the .bare-first reachability, --force-worktrees as a flag distinct from --force, and the --ls --size attribution. Also the open minors: T3 (a refused or partial removal feeding neither the removal nor the gate), T4, and N4 (Losses::of([one]) resolving its unreachable arm to NothingToLose, the deleting direction, in a module whose discipline is to fail towards keeping).
• Decide and state PR Reclaim the agent git worktrees stranded inside live workspace clones #442's fate: rebase onto the decision, supersede it, or land it first as a floor. Whichever it is, no partial state where T1 is shipped unfixed, since that is an unflagged data-loss path.

Every check verified against the full 40-char head SHA before the review gate. wf-tdd to build, wf-review to review, stop at approved.

[blooop]

scope note from the keystone. #445 is resolved: the unit is a nesting site plus everything nested inside it, one subtree decided bottom-up and conjunctively, and the only metadata operation is git worktree remove <the path git printed>, per registration, by name. Read that comment before starting; this note only records where it moves this ticket's scope.

Net effect is a simplification, not more work.

Moves from the carry-over list to the delete list. MetadataGate, metadata_gate(), registration_goes_on_protecting, WorktreeReport::metadata_held_back, and Git::worktree_prune itself. The S1 fix was a correct guard on an operation whose blast radius cannot be named at plan time, and the decision deletes the operation. Do not carry the gate forward; there is nothing left for it to gate.

T2's test changes character. It stops asserting that a gate closed and starts asserting that no git invocation ever names a registration the pass did not read from a listing. That is the absence-of-a-path test this ticket's scope asks for, and the mechanism is that Recorded's only constructor parses a listing. Measured on 2.51.1 and 2.43.0: a per-registration removal cannot even act on the three states worktree prune reaches and worktree list never shows, so this is unreachable rather than unreached.

T3 needs no fix. A refused or partial removal forgets nothing, because forgetting is a consequence of a completed subtree removal. There is no third outcome to feed anywhere.

New in scope, small. A directory in the worktrees place that this clone cannot account for (a worktree of another repository, a plain directory, an unreadable gitfile) becomes a site with a verdict that can only be stands, instead of today's continue at agent_worktrees.rs:1131. That closes the other half of review S4.

Three false claims are corrected in the same change, one more than the map named: clients/git.rs:513-515, flows/agent_worktrees.rs:64-66 ("git worktree remove is no use from a host — it resolves the registered path", which is backwards: it works because the path does not resolve), and docs/cleanup.md:283-286.

One implementation detail that is easy to get wrong and was probed. Variant fields of a pub enum are as public as the enum, so Collectable::Directory { nested: vec![] } is forgeable from outside the crate and compiles. The payloads have to be structs with private fields, the way CloneWorktrees already does it, and then the same line is error[E0451]. This repo's public-api.rest.txt snapshot is where the absent constructor gets pinned.

Still blocked on #446, which owns the predicate. The unit constrains it: whatever it decides has to compose conjunctively over a subtree, so a foldable verdict rather than a boolean.