fix(runtime): warn when --bare skips worktree subsystem bootstrap

[bug-ops]

Summary

• src/runner.rs's worktree subsystem bootstrap gate (agents_config.worktree.enabled && !exec_mode.bare) had no else branch for the enabled && bare combination — WorktreeManager was never constructed and no warning was logged either, so a config with worktree.enabled = true was silently ignored under --bare.
• This is the 6th confirmed instance of the --bare-mode-silently-skips-a-subsystem defect class (prior instance: MagicDocs registration never fires in --bare mode despite [magic_docs] enabled=true #6127 for MagicDocs).
• Practical impact: a sub-agent with permissions.worktree = true running under --bare lost its worktree isolation guarantee (INV-1/INV-3, specs/063-worktree-subsystem/spec.md) with nothing surfaced to the operator — notable because --bare is the documented/recommended flag for CI/scripted sessions, exactly where this matters.

Changes

• src/runner.rs: added an else if agents_config.worktree.enabled && exec_mode.bare branch emitting a tracing::warn! describing the skipped isolation guarantee. WorktreeManager is still never constructed under --bare by design — that would defeat the point of --bare as a fast, dependency-light path for CI/scripting.
• src/runner.rs: added bare_flag_skips_worktree_guard unit test alongside the existing sibling guard tests (bare_flag_skips_{code_indexer,scheduler,mcp_connect,gateway_spawn}_guard).
• crates/zeph-core/src/agent/builder.rs: updated Agent::with_bare_mode's doc comment to list the worktree subsystem among those --bare skips.
• CHANGELOG.md: added a Fixed entry under [Unreleased].
• .local/testing/playbooks/worktree.md (main repo): added Scenario 17 with reproduction steps and a negative control.
• .local/testing/coverage-status.md (main repo): added a row for this behavior (status Untested, pending live-session confirmation).

Review notes

Went through the reduced bug-fix chain (root cause and fix were already scoped on the issue via a prior CI recommendation, so the debugger step was skipped):

• Adversarial critique (impl-critic): approved, no blocking findings. Verified the warning's factual claim against crates/zeph-subagent/src/manager/spawn.rs (subagents do run unisolated under --bare exactly as the message states).
• Test coverage validation (tester): 9/9 bare_flag tests pass independently, no regressions. Two advisory (non-blocking) gaps noted — pre-existing test debt unrelated to this change, and an optional negative-control test — both left as follow-up suggestions, not blockers.
• Code review: approved, no changes requested.

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml -p zeph --bins -E 'test(bare_flag)' — 9/9 passed, including the new bare_flag_skips_worktree_guard
• Live-session confirmation of the warning firing (playbook Scenario 17) — tracked as Untested in coverage-status.md pending the next CI cycle

Closes #6256