fix: filter worktrees by version in GitCommand

[sea-odoo]

Problem

When running odev pull -V <version> (e.g. during an AI upgrade session), the command iterated over all local worktrees (master, 13.0, 14.0, 16.0, 17.0, 18.0, 19.0, etc.) instead of only the requested version. This caused unnecessary fetching, slow startup, and noisy log output.

Root Cause

The GitCommand.worktrees property in odev/common/commands/git.py yielded all worktrees from all repositories without checking the --version (-V) argument, even though the argument was already defined on the GitCommand class.

Fix

Added a filter in the worktrees generator so that when self.args.version is set, only worktrees whose name matches the requested version are yielded. This ensures commands like pull, fetch, and worktree only process the relevant version.

Impact

• odev pull -V 19.0 now only pulls worktrees for version 19.0
• odev fetch -V 19.0 now only fetches worktrees for version 19.0
• No behavior change when -V is not specified (all worktrees are still processed)

AI Agent & SSH Agent Fixes

• Added to whitelisted environment variables for the Gemini agent.
• Modified to respect environment variable, preventing crashes in sandboxed environments.
• Improved secret decryption to gracefully handle failures (e.g., missing SSH agent) by treating them as missing secrets.

AI Agent & SSH Agent Fixes

• Added GEMINI_API_KEY to whitelisted environment variables for the Gemini agent.
• Modified SecretStore to respect ODEV_NO_SSH_AGENT environment variable, preventing crashes in sandboxed environments.
• Improved secret decryption to gracefully handle failures (e.g., missing SSH agent) by treating them as missing secrets.

[brinkflew]

Code ok but pre-commit fails