feat(picker): surface alt-x decline reasons in the header

[max-sixty]

When alt-x in the wt switch picker declines to remove a row, the row visibly stays put but the reason only drained to stderr after the picker exited — the user pressed the key, nothing seemed to happen, and the "why" scrolled past on quit. This adds an in-picker echo of that reason.

A new generation-guarded HeaderFlash shows a one-line message in the picker header (skim reserves exactly one non-selectable chrome line — the header — and has no footer slot) for a beat, then self-clears back to the column labels. It's wired into all three "can't remove" surfaces, each styled to match the canonical representation that path already stashes for the on-exit drain:

• current worktree → ○ Can't remove the current worktree (info — a by-design decline)
• unmerged branch-only row → ○ Kept <branch> — branch is unmerged (info — a by-design retain)
• main worktree / dirty / locked → ✗ The main worktree cannot be removed (error — a genuine rejection)

The full diagnostic still drains to stderr on exit; the flash is additive. This closes the TODO(picker-feedback) the keep paths carried.

The same change also aligns the --prs loading marker with the watchdog and the picker's other in-flight placeholders (↳ <dim>Fetching…</>): loading open PRs… → ↳ Loading open PRs…. The hint symbol sits in the pointer gutter and "Loading" stays aligned at column 2 (↳ is the same two columns the old indent used).

Implementation notes

HeaderFlash is shared picker-lifetime between the header item (which renders it) and AltXRemover (which sets it). flash_header sets the message, repaints, and spawns a short-lived timer that clears it after HEADER_FLASH_DURATION and repaints again. The clear is generation-guarded — a newer flash arriving mid-beat replaces the old one and isn't wiped by the old timer — and clear_if_current reads the generation under the message lock so the check and clear are atomic against a concurrent set.

Testing

Unit tests cover the HeaderFlash mechanism (set / generation-guarded clear / display priority of flash › loading › labels), the keep-path symbol, and the timer driven to completion (so the detached thread's clear+repaint is covered under nextest's process-per-test). A PTY integration test confirms the flash actually paints on alt-x of an unremovable row. The loading-marker assertions were updated in lockstep.

This was written by Claude Code on behalf of max

[worktrunk-bot]

Clean, additive feedback layer — the HeaderFlash generation guard reads correctly (the bump-before-lock / load-under-lock ordering makes the stale-clear race unrepresentable), and the three keep/error surfaces each match the symbol of the diagnostic they already stash (○ for the by-design retains, ✗ for the genuine rejection). Coverage of the mechanism (set / guarded clear / display priority) and the self-clearing timer is thorough.

Holding the verdict as a COMMENT rather than approving: this edits src/commands/picker/mod.rs, which carries the alt-x removal dispatch (is_force() / do_removal / branch force-delete), and per the repo's data-loss-surface review policy a change to that file is a human's call to merge. For the record, the removal dispatch in apply and the background-removal paths are unchanged here — the new flash_header calls sit only in the declined-removal arms (keep current worktree, keep unmerged branch-only row, and the Err rejection arm), so this is feedback-only and doesn't alter what gets deleted. Flagging for @max-sixty's merge decision on the deletion-surface grounds, not on any correctness concern.

One inline doc nit below.