feat(git): add worktree branch roots

[pcristin]

Summary

Fixes #351.

Adds first-class git worktree awareness by introducing a git context resolver and using branch nodes as the graph root beneath each project:

• Detect git repos, linked worktrees, detached HEADs, branch slugs, canonical common root, HEAD/base SHAs, and git dirs.
• Add Project -[:HAS_BRANCH]-> Branch and reparent top-level structural containment to the branch node while preserving existing file/folder/function qualified names.
• Surface git/worktree metadata in list_projects and index_status.
• Add focused tests for non-git paths, linked worktrees, branch-root graph shape, and MCP status metadata.

Notes

• Pure C implementation, no new dependencies.
• New cbm_popen usage is limited to git metadata lookup and is documented in scripts/security-allowlist.txt.
• This PR is over the preferred 500-line guideline because it includes the resolver plus regression tests in one issue-scoped change.

Verification

• make -f Makefile.cbm build/c/test-runner passes.
• git diff --check passes.
• Touched files pass clang-format dry-run.
• scripts/test.sh was run; it fails in existing incremental dump/status tests with final summary 3513 passed, 112 failed, 16 skipped.
• scripts/lint.sh was run; it fails because cppcheck is not installed locally and because of existing broad clang-tidy findings outside this diff. The diff-specific formatting finding was fixed.

[DeusData]

Heads-up: this project now validates every PR automatically — tests, lint, security/license gates, and DCO sign-off (CONTRIBUTING.md). Your branch predates this, so CI will flag the missing Signed-off-by trailers. Fixing it is one command: git rebase --signoff origin/main && git push --force-with-lease. No other action needed — and thanks again for the contribution!

[pcristin]

@DeusData thanks!
Should I move further for this PR? Or postpone it a bit (based on the #351 latest comments about implementation details)?

[DeusData]

Hey @pcristin, you can work further on it for sure. I just need a little break, this week was tough. Sorry for the delay (the disadvantage of being a solo maintainer). I will dig into all PRs tomorrow

[pcristin]

Hey @DeusData !
Whenever you need some help with maintaining the repo - ping me and let's discuss. Really excited to help you out

[DeusData]

Thanks @pcristin — this is clean, well-scoped work, and first-class git worktree/branch awareness is genuinely valuable (it's exactly how a lot of us work day to day).

I reviewed and built it locally on a full ASan+UBSan run: it's a clean merge and the suite is fully green — the local failures you saw were environmental (missing cppcheck / partial toolchain), not from your change, so no worries there. The validate-before-popen handling on the git lookups and the accurate security-allowlist.txt note were especially nice to see.

Merging now. Thank you for the contribution! 🙏