feat(tui): managed worktrees

[fcoury-oai]

Why

Codex users already work across multiple local Git worktrees, and the App can create managed worktrees under $CODEX_HOME/worktrees. The CLI/TUI did not have an equivalent first-class workflow: users had to create raw Git worktrees themselves, sessions did not explain which workspace they belonged to, and cleanup/removal had no Codex ownership boundary.

This PR adds a managed worktree workflow that keeps CLI/TUI sessions legible without taking over ordinary Git worktrees. CLI-created worktrees use predictable sibling paths, App-created worktrees are still discoverable, and only Codex-owned worktrees can be removed through Codex.

What Changed

• Added a new codex-worktree crate for managed worktree lifecycle behavior:
  • create/reuse sibling worktrees while preserving relative cwd from repo subdirectories;
  • store Codex ownership/thread metadata beside Git worktree metadata;
  • support dirty-source policies fail, ignore, copy-tracked, copy-all, move-tracked, and move-all;
  • list CLI-managed, App-managed, and raw Git worktrees distinctly;
  • refuse removal of worktrees Codex does not own.
• Added CLI entry points for startup and lifecycle management:
  • --worktree <BRANCH>
  • --worktree-base <REF>
  • --worktree-dirty <MODE>
  • codex worktree list|path|remove|prune
• Added a TUI /worktree workflow for creating, switching, locating, and removing worktrees, plus workspace labels in startup, resume, and fork surfaces.
• Added remote app-server-backed worktree support so the same TUI workflow works over --remote.
• Made dirty transfers safer:
  • remote tracked patches preserve exact diff output;
  • failed creates roll back newly-created worktrees/branches instead of leaving stray checkouts behind;
  • move policies only clean the source after the destination has been populated safely.

How to Test

CLI lifecycle

1. From a Git repo, start Codex with a managed sibling worktree:

   cargo run --bin codex -- --worktree fcoury/worktree-smoke --worktree-dirty ignore

2. Confirm the session starts in a sibling path such as ../codex.fcoury-worktree-smoke.
3. Run:

   cargo run --bin codex -- worktree list
   cargo run --bin codex -- worktree path fcoury/worktree-smoke

   Confirm the list distinguishes cli, app, and raw git entries.
4. Try removing a raw Git worktree from the list and confirm Codex refuses with refusing to remove a worktree not managed by Codex.

TUI workflow

1. In the TUI, run /worktree and create a new worktree.
2. Start from a dirty checkout and choose Move tracked.
3. Confirm staged + unstaged tracked changes move into the destination, untracked files remain in the source, and the TUI reports that warning.
4. Re-open /worktree, select the current row, and confirm it says Already in worktree ....
5. Use /worktree remove <clean-worktree> and confirm the removal prompt appears before deletion.

Remote regression

1. Start a loopback app-server and connect with --remote.
2. In a remote TUI session, repeat the dirty Move tracked flow above.
3. Confirm the transfer succeeds and no corrupt-patch error appears.
4. Create from an intentionally incompatible base ref so patch application fails, and confirm no new sibling worktree or branch is left behind afterward.

Targeted tests:

• cargo test -p codex-worktree
• cargo test -p codex-tui remote_worktree::tests::raw_git_stdout_preserves_patch_newline_and_disables_output_cap

Documentation

This adds user-facing CLI flags, codex worktree subcommands, and the TUI /worktree workflow. The Codex CLI documentation on developers.openai.com should be updated before this ships broadly.