fix(daemon): linked-worktree indexing opt-in surfaces reopen, concurrent-open, and shutdown defects

[ScriptedAlchemy]

Context

f347a0a46 (fix(index): require opt-in for linked worktree scopes) gates project-open code-index activation for a linked worktree behind sync.watch_linked_worktrees (default false). daemon::tests::runtime_identity::concurrent_same_identity_worktrees_keep_exact_server_and_scheduler_bindings predates that contract and still asserts the linked route serves tracedecay_files; it now correctly answers code-graph-unavailable.

While repairing that test (production fixes for the federated store locator, the scope-digest pairing, and the observability store-owner identity are landing separately), a lane prototyped the opt-in (sync.watch_linked_worktrees = true through the production configuration surface plus a wait on subscribe_serving_seats / generation publications for the boundary) and reverted it because indexing the linked route exposes three further defects, each needing its own root cause:

1. Reopening the linked route fails with a different retained runtime is already registered for this project — crates/tracedecay-daemon-service/src/invocation/registrars.rs (~line 1204) requires Arc::ptr_eq on a ports Arc that a reopen necessarily replaces. Same class as the observability-registry identity defect (store authority, not object identity, is the identity).
2. Concurrent open intermittently blocks ~30 s at linked phase=graph_admitted elapsed_ms=30070 and then fails project Context Scout durable owner is unavailable (crates/tracedecay/src/daemon/engine.rs ~line 183).
3. engine.shutdown_all() then exceeds the test's 5 s bound. The bound must not be extended; find what holds shutdown.

Acceptance

• With sync.watch_linked_worktrees = true, a second worktree of the same project opens, indexes, reopens, and shuts down within the existing bounds, concurrently with the primary.
• No timeouts extended, no retries or polling added; waits are on typed signals (serving seats, publications, route cancellation).
• concurrent_same_identity_worktrees_keep_exact_server_and_scheduler_bindings (or its restated successor) green on Linux and macOS CI.

Targets codex/tracedecay-total-redesign-plan-reopened (#707). Refs #863, #896.

[ScriptedAlchemy]

Non-opt-in twin of these defects, observed while restating runtime_identity::concurrent_same_identity_worktrees_keep_exact_server_and_scheduler_bindings against the f347a0a46 contract (default sync.watch_linked_worktrees = false, production code unmodified), under load and at CPUQuota=25%:

• runtime_identity.rs:341 reopen → Config { message: "project Context Scout durable owner is unavailable" }, preceded by project_open_phase project=<linked> phase=graph_admitted elapsed_ms=32598 (30103 ms in an unquotaed run);
• runtime_identity.rs:382 → linked-worktree shutdown must remain bounded: Elapsed(()) (5 s budget);
• runtime_identity.rs:115 → the initial concurrent open, same Context Scout owner unavailability.

Mechanism from the logs: with code_index=linked_worktree_disabled the linked route's deferred advisory runtime parks on advisory_deferred_attempt phase=generation_unavailable attempt=await_next_publication for a publication that indexing will never produce on that route; when the server is dropped and reopened that task is still resolving (code_index_query_authority outcome=degraded error="durable query cursor key is unavailable"), and the reopen's ensure_context_scout_owner_before_advertising (crates/tracedecay/src/daemon/engine.rs ~166) sees ContextScoutDurableStartupOutcomeV1::Unavailable after startup_inner's update_state write (crates/tracedecay-agent-hosts/src/agents/context_scout_v2/store.rs ~521) fails to get the lane. So a disabled linked route needs a typed terminal for its deferred owners (nothing to wait for) instead of an open-ended wait, and Context Scout startup must not depend on that lane. Same lifecycle class as #901/#908.