Provision session worktrees and mount them through virtio-fs

Parent: #526

Outcome

Every Git-backed session receives an isolated, host-visible working tree that is mounted RW at guest /workspace; multiple sessions from one repository operate concurrently without sharing mutable working-tree or Git administrative state.

Scope

• Prepare one host worktree/branch per session using hardened Git execution.
• Define and enforce the exact staged/unstaged/untracked snapshot fidelity contract; incomplete capture fails rather than silently starting from clean HEAD.
• Reuse/extract Brood Box's linked-worktree reconstruction:
  • validate .git/commondir containment;
  • create guest-local Git metadata;
  • carry HEAD/refs/config/state deliberately;
  • use the common object store through an alternates path.
• Mount the prepared worktree RW through go-microvm virtio-fs at /workspace.
• Extend go-microvm to use libkrun v1.19.4's host-enforced read-only virtio-fs API for the shared Git object store and other ancillary mounts.
• Preserve dirty worktrees and branches on deletion unless explicit safe cleanup conditions hold.
• Reject or explicitly defer non-Git sources and direct-existing-worktree mode for the first delivery.

Acceptance

• Two sessions created from the same repository have different worktree roots, branches, indexes, VMs, and writable files.
• Guest edits appear immediately in the corresponding host worktree.
• Guest commit/reset/clean/config/hook/update-ref/gc activity cannot mutate the source checkout or a sibling session's mutable Git metadata.
• The source repository may gc/repack without corrupting an active session.
• Malicious .git, commondir, symlink, hardlink, and path-escape inputs fail closed.
• Session cleanup never silently discards uncommitted changes.