Fix generated path handling for OpenLoops route worktrees

[andrei-hasna]

Summary

• add shared Git project path helper that preserves repo subdirectory routing but rejects generated .tmp/.bun-cache/node_modules/dist paths inside a checkout
• apply the helper to route throttling and workflow template worktree validation
• make local and remote required-worktree preparation fail closed unless repoRoot is the actual Git top-level
• keep boundary scans from traversing generated task caches and allow hygiene repo naming for managed worktrees

Validation

• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun run typecheck
• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun test src/lib/git-project.test.ts src/no-private-cloud-boundary.test.ts src/cli/index.test.ts src/lib/hygiene.test.ts src/lib/executor.test.ts src/lib/templates.test.ts (270 pass, 0 fail)
• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun run test:boundary
• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun test (697 pass, 15 skip, 0 fail)
• git diff --cached --check
• staged credential-pattern scan

Review

Independent adversarial reviewer found a nested generated-dir gap; fixed by scanning every relative path segment and adding src/lib/git-project.test.ts coverage for repo/packages/sdk/.tmp and .bun-cache.

Task: e67e4e71-d27b-40e2-81e9-a7362e9e5cc7

[andrei-hasna]

OpenLoops worker review is blocking merge for now.

Independent adversarial reviewer found a managed-worktree hygiene bug in this PR:

• src/lib/hygiene.ts now allows ~/.hasna/loops/worktrees/* cwd values to become repo-scoped, but repoSlugFromCwd() still returns slugify(basename(cwd)).
• OpenLoops templates create managed worktree paths as //[/relativeCwd], so a task worktree gets a run-specific repo slug instead of the repository slug.
• Local reproduction on the PR merge tree: buildNameHygieneReport() for cwd /home/hasna/.hasna/loops/worktrees/open-loops/8d34d54a-3e60-4dc2-84ba-7ea693727c32-d4976308 produced scopeSlug "8d34d54a-3e60-4dc2-84ba-7ea693727c32-d4976308" and newName "repo-8d34d54a-3e60-4dc2-84ba-7ea693727c32-d4976308-lint", where the expected repo scope would be open-loops.

Required before merge: derive the repo slug from the managed worktree repo segment, or otherwise from the git top-level repository identity, for ~/.hasna/loops/worktrees//[/relativeCwd], and add focused hygiene test coverage for managed worktree cwd paths.

Validation otherwise completed on a local merge of origin/main ff62f37 + PR head 07c500d: focused tests passed, typecheck passed, boundary scan passed, build passed, and the full suite passed with bun test --timeout=15000 (713 pass, 15 skip). The default local bun test run has a separate 5s timeout in existing route tests that reproduces on unmodified origin/main or under local load, so it is recorded as base/environment timing rather than this PR regression.

[andrei-hasna]

Closing unmerged at the bounded repair/review cap.

Exact head: 70142c8
Frozen scope: PR75-generated-worktree-path-v1@e3ce4b4
Hosted CI: run 29765183956

Ubuntu, PostgreSQL storage, and runner-image security passed. macOS failed a PR-introduced frozen-scope case: canonical /private/var repository roots were compared with lexical /var cwd paths, so a valid ..sdk subdirectory was treated as outside the repository and its relative cwd was dropped. A separate drain-test timeout is pre-existing and is not the reason for closure.

The repair cycle is capped; no additional implementation/review loop will be opened on this PR. The pushed branch and canonical recovery worktree are preserved so a later replacement can be a narrow canonical-path fix. Main is unchanged. Reopen is the rollback.