v0.8.2 — project detection without git, whoami guards, merge-project

A bug fix: agents whose sandbox git refuses the checkout could join a stray project.

What happened

Codex runs its commands as a sandbox account that does not own the repository, so git refused it (detected dubious ownership). The client could not read the git remote, and the agent improvised whoami codex-01 --project mwg-pixel-dungeon - a session name as its family, and a project id nobody else was in. Its messages, open questions and warnings included, were invisible to the other agents.

Changes

• Client: the project (and the repository root) are read from .git/config directly when git fails - worktrees included - so a sandbox's git no longer matters.
• Server: whoami refuses a family that is a session name (codex-01 -> bad_family, use codex) and a bare project name that is the tail of a known project (unknown_project, with did_you_mean).
• coord-db merge-project OLD NEW [--apply]: moves every row of a project into another (a stray id, or a renamed repository) in one transaction, and posts a coord-server notice listing the still-open questions it moved - their ids are older than the agents' cursors, so poll alone would never show them.
• Skill: never pass --project or a session name to whoami; on unknown_project or a project that is not host/owner/repo, tell the human.

Upgrading from 0.8.1

uv sync, restart coord-server; refresh plugin copies. If coord projects lists a stray project, coord-db merge-project <stray> <host/owner/repo> (dry run), then --apply.

Install

uv tool install https://github.com/datamoc/coord/releases/download/v0.8.2/coord-0.8.2-py3-none-any.whl
npm install -g https://github.com/datamoc/coord/releases/download/v0.8.2/coord-client-0.8.2.tgz

Tested: test_coord.py 45/45 and the TS suite 23/23 on Windows.