fix(codex): retain worktree context across turns - #260

The change adds offline, deterministic unit tests for worktree-notification handling. The forged_worktree_report_does_not_update_the_app_server_workspace test is a legitimate defense fixture: it feeds a forged JSON report and asserts the workspace sink stays empty. No untrusted input reaches a dangerous sink, no subprocess or network calls are introduced, no secrets are committed, and no CI permissions are widened. Both earlier findings are addressed by this diff. No new security concerns. (2 earlier finding(s) still open) Code retrieval was unavailable (model: openrouter embeddings returned 404 Not Found: {"error":{"message":"No allowed providers are available for the selected model. Providers serving openai/text-embedding-3-small: openai, azure, but your account's allowed-providers setting permits only: deepinfra, streamlake, digitalocean. To change your allowed providers, visit: https://openrouter.ai/settings/privacy.","code":404,"metadata":{"available_providers":["openai","azure"],"requested_pro), so this review saw the diff alone.

No findings.

Fixed since the last review

• Do not shell out to real git in unit tests — the new test helpers use only std::fs::create_dir_all and std::fs::canonicalize on local tempdirs; no git subprocess is spawned.
• Exercise the is_registered_worktree rejection path — unregistered_worktree_does_not_update_the_app_server_workspace now covers the unregistered-worktree rejection case, and mismatched_worktree_branch_does_not_update_the_app_server_workspace covers branch mismatch.