feat: worktree management — list, switch, create, remove, lock/unlock

[stevenpollack]

Summary

Adds a Worktrees popup (Shift+W, available from any tab) to manage
git worktrees without leaving gitui. Motivation:
tooling that spins up parallel worktrees (and general multi-worktree workflows) had no in-app way
to see or hop between them — you had to quit and relaunch pointed at another path.

Related: #2990 (enhance workspace functionality), and touches the worktree area of #2920 / #2876.

What it does

From the Worktrees popup:

• List — primary (main) + all linked worktrees, each with branch, path, and 🔒/(invalid)
  markers; * marks the one gitui is currently in.
• Switch (Enter) — reopens gitui against the selected worktree (reuses the existing
  submodule-style repo-switch flow; skipped for the current tree).
• Create (c) — prompts for a path (absolute, or relative to the repo root); creates a linked
  worktree with a new branch named after the final path component. Missing parent directories are
  created (libgit2's worktree_add only makes the leaf, unlike git worktree add).
• Remove (Shift+D) — confirmation dialog (accepts y/n); prunes the worktree and deletes
  its working dir. Refused, with a clear message, if the worktree is the current one, is locked, or
  has uncommitted/untracked changes — mirroring git worktree remove without --force (libgit2
  does not refuse a dirty remove itself, so the check is done in-app via is_workdir_clean).
• Lock / unlock (l) — toggles the lock state.

Design notes

• git2-native only — uses Repository::{worktrees, find_worktree, worktree, open_from_worktree}
  and Worktree::{prune, lock, unlock, is_locked, validate}; no shelling out to the git binary,
  per the repo convention.
• Backend lives in asyncgit/src/sync/worktree.rs
  (get_worktrees / create_worktree / remove_worktree / toggle_worktree_lock), re-exported
  from sync/mod.rs, with unit tests.
• UI follows the existing submodules-popup pattern (VerticalScroll + draw_list); registered
  via the setup_popups! macro. The switch path reuses InternalEvent::OpenRepo.
• Scope intentionally excludes move / repair — libgit2 has no API for them, and shelling out
  would break the no-git-binary convention.

Bonus fix

While wiring the repo-switch, found and fixed a pre-existing bug: the first keystroke after
switching worktree/submodule was dropped, because each app restart spawned a fresh input-reader
thread and the outgoing thread could consume one event. The Input reader is now created once in
main.rs and shared across restarts (8672275e).

Testing

• make check green (fmt + clippy --workspace --all-features + nextest + tombi + deny), 324
  tests including new backend tests for create/remove/dirty-refusal/lock.
• Manually exercised end-to-end (list, switch, create incl. nested paths, lock/unlock, remove, and
  the dirty-remove refusal).

Notes for reviewers

• Adds a project-level CLAUDE.md (AI dev-harness notes). Happy to drop it if it's unwanted upstream.
• WorktreeInfo carries #[allow(clippy::struct_excessive_bools)] for its four independent flags,
  matching existing precedent in src/components/status_tree.rs.
• CHANGELOG updated under ## Unreleased.

🤖 Generated with Claude Code

[stevenpollack]

Code review

An independent review of this branch surfaced two real defects in remove_worktree, both now fixed on the branch:

1. Data-loss window on non-UTF8 worktree paths — the "uncommitted/untracked changes" guard was nested inside worktree.path().to_str(), so a non-UTF8 path skipped the check entirely and the working directory was pruned regardless of its contents. Fixed by passing the path through RepoPath: From<PathBuf> so the guard always runs (behavior unchanged for UTF-8 paths): 80322f01.

2. Staged-only changes bypassed the guard — the guard used only is_workdir_clean, which compares the index to the working directory and therefore misses staged-but-uncommitted changes (HEAD vs index). A worktree whose sole changes were git added read as clean and was removed, whereas git worktree remove refuses it. Fixed by composing an additional StatusType::Stage check: 7e96b0f3. Both fixes ship with regression tests.

Minor (not changed): when gitui runs inside a linked worktree whose main repo is bare, the synthesized (main) list entry can show an incorrect path (commondir().parent() isn't a working dir). Display-only, no data risk.

The rest — switch/create/lock guards, the confirm y/n gating and modal ordering, git2 prune usage, and the shared-Input refactor — reads as correct. make check is green (325 tests).