Add worktree-scoped Git execution

[skarim]

Git worktrees share branch refs and objects, but each has its own HEAD, index, working files, and paused Git operations. This PR adds explicit worktree-scoped Git execution: the foundation for independent stacks in separate checkouts and for one stack whose layers live across several worktrees.

Functionality and user impact

• Discover registered worktrees and the branches they hold, including branches reserved by an interrupted rebase. Keep the shared Git directory distinct from each worktree's local Git directory.
• Run Git in the selected checkout without changing the process directory or inheriting another checkout's index/environment. Refuse missing, replaced, or unrelated repository locations instead of executing somewhere else.
• Keep conflict inspection, rebase continuation, and cherry-picks in the correct worktree. Rebases disable automatic stashing and automatic updates of other refs; date-preserving rebases retain their settings through conflicts.

Boundary: this PR does not move stack metadata, add navigation flags, or automatically run stack commands in other worktrees. Shared tracking follows in #528, cross-worktree rebase/sync in #529, and distributed modify in #521. Discovery requires Git 2.36+; this supports existing worktrees, not their creation or removal.

Reviewer guide

• internal/git/worktree.go: ForWorktree and gitClient bind execution to a repository/worktree identity. Focus on rejecting a changed Git directory rather than falling back to the caller.
• internal/git/worktree.go: Worktrees, rebaseBranch, and resolveMainWorktree handle ownership during detached rebases and separate Git directories. Existing core.worktree backlinks are used; unknown checkout paths are not guessed.
• internal/git/git.go: configureCommand, rebaseArgs, and runRebaseCommand isolate the environment, set rebase policy, and distinguish a failure to start from a recoverable conflict.
• internal/git/gitops.go: follow RebaseOnto, RebaseContinue, and the conflict/cherry-pick helpers to confirm checkout-sensitive operations stay on the scoped receiver.

Related issues

The completed stack closes #459 (tracking survives worktree removal), closes #35 (rebases of branches checked out elsewhere), and closes #87 (sync with a checked-out trunk).

Part 1 of the four-PR split of #520; the next layer is #527.