fix: make dependencies available in isolated worktrees

[aaroncoville]

What & why

Spawning an agent into an isolated worktree gives it a checkout with no node_modules. Typecheck then fails on missing type definitions and tests and build fail on missing packages.

This links the base checkout's dependencies into the worktree right after the worktree is created successfully, and removes that link again before the retention and garbage-collection checks so an untracked entry cannot make a worktree look permanently dirty. An existing entry is left alone, and a link failure is logged without blocking the spawn, so the worst case is the behaviour we already have today.

Two notes for the reviewer. Cleanup only removes an entry that is a symlink and resolves to the base checkout's node_modules a real directory, or a link pointing anywhere else, is left alone, and there are tests pinning both refusals. And because the worktree shares the base's node_modules, an npm install run inside a worktree writes through the link into the base checkout; that is inherent to sharing rather than copying.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs
• Build / CI

Evidence

Before

A fresh isolated worktree, running the project's own typecheck:

$ npm run typecheck
error TS2688: Cannot find type definition file for 'electron-vite/node'.
error TS2688: Cannot find type definition file for 'node'.

With the dependency-link step removed, three of the regression tests fail:

not ok 553 - links the base node_modules into an isolated worktree
not ok 556 - does not follow the dependency symlink when removing a worktree
not ok 558 - reports a failed link without throwing
# tests 559
# pass 556
# fail 3

After

The same command in the same worktree, with the dependencies linked:

$ npm run typecheck
errors: 0

Full suite with the change applied:

# tests 564
# pass 564
# fail 0

$ npm run build
build_exit=0

How I tested it

• OS: macOS (darwin 25.6.0), Munder Difflin 0.4.5
• Steps:
  1. Created a detached worktree from main with no node_modules and ran npm run typecheck — reproduced the two TS2688 errors above.
  2. Linked the base checkout's node_modules and re-ran the identical command in the identical worktree — 0 errors.
  3. npm run test:focused on a clean branch cut from main: 564/564 (baseline on main is 552; this adds 12).
  4. Removed the symlink operation and re-ran the suite to confirm the tests actually bite — 3 fail, listed above; restored and back to 559/559.
  5. npm run typecheck — 0 errors. npm run build — succeeds.

The deletion guards are covered by name: removing the symlink type check makes does not remove a real worktree node_modules directory fail, and removing the resolved-target comparison makes does not remove a worktree node_modules link to another directory fail. Teardown safety was the other case worth being careful about: git worktree remove --force must not follow the link and delete the base checkout's node_modules. Test 556 covers that, and it asserts the symlink exists before the removal runs.

Checklist

• Before and after evidence is attached above, under both headings.