feat(worktree): require managed task trackers

[chubes4]

Closes #932

Summary

• require valid tracker metadata by default for agent and machine worktree creation
• remove the agent-tool opt-out while retaining explicit operator-local CLI creation
• persist explicit or environment-projected tracker metadata through local and remote workspace paths
• require code-task worktrees to carry their source tracker

How to test

1. Run php tests/worktree-add-lifecycle.php.
2. Run php tests/worktree-add-tool-tracker-contract.php.
3. Run git diff --check origin/main...HEAD.

Compatibility

Manual CLI worktree creation remains operator-local unless --require-task-tracker is supplied. Agent tools and direct ability calls now fail closed by default. Trusted callers can explicitly pass require_task_tracker=false; internal CodeTaskWorkspaceInterface implementations receive tracker arguments.