feat(worktree): git worktree per task to isolate shared /repos (ORCH-2 / S-4)

- add src/git_worktree.py: ensure/remove/get_worktree_path
- config: worktrees_dir=/repos/_wt
- launcher: agent runs in per-branch worktree; task-file + commit/push in worktree; no shared checkout
- qg/checks: read artifacts + run make test from worktree (branch arg, backward-compatible)
- webhooks/plane: pass branch into QG dispatch; review fallback from worktree
- webhooks/gitea: keep read-only branch --contains in main clone (documented)
- tests: test_git_worktree.py (isolation) + update test_launcher write-task-file
- docs: ARCHITECTURE worktree section + BUGFIXES_2026-06-02_ORCH2

Preserves B-1/B-2/S-1/S-5 fixes (paths now point at worktree).

src/webhooks/gitea.py

@@ -146,7 +146,9 @@ async def handle_ci_status(payload: dict):
     if not branch:
         sha = payload.get("sha", "")
         repo_name = payload.get("repository", {}).get("name", settings.default_repo)
-        # Try to find task by checking git branch containing this SHA
+        # Try to find task by checking git branch containing this SHA.
+        # ORCH-2 / S-4: this is a READ-ONLY query of remote-tracking refs in the main
+        # clone (no checkout / no mutation), so it is safe to keep on /repos/<repo>.
         try:
             result = subprocess.run(
                 ["git", "-C", os.path.join(settings.repos_dir, repo_name),

src/webhooks/plane.py

@@ -304,7 +304,8 @@ async def _try_advance_stage(
 
         # Determine args based on QG function
         if qg_name in ("check_analysis_approved", "check_analysis_complete", "check_architecture_done", "check_tests_passed", "check_reviewer_verdict"):
-            passed, reason = qg_func(repo, work_item_id)
+            # ORCH-2 / S-4: pass branch so artifacts are read from the task worktree.
+            passed, reason = qg_func(repo, work_item_id, branch)
         elif qg_name in ("check_ci_green", "check_tests_local"):
             passed, reason = qg_func(repo, branch)
         elif qg_name == "check_review_approved":
@@ -327,8 +328,10 @@ async def _try_advance_stage(
                 else:
                     # No open PR but review file exists — check file-based
                     import os
-                    _review_path = os.path.join(_s.repos_dir, repo, f"docs/work-items/{work_item_id}/12-review.md")
-                    _review_path2 = os.path.join(_s.repos_dir, repo, f"docs/work-items/{work_item_id}/09-review.md")
+                    from ..git_worktree import get_worktree_path as _gwp
+                    _wt = _gwp(repo, branch) if os.path.isdir(_gwp(repo, branch)) else os.path.join(_s.repos_dir, repo)
+                    _review_path = os.path.join(_wt, f"docs/work-items/{work_item_id}/12-review.md")
+                    _review_path2 = os.path.join(_wt, f"docs/work-items/{work_item_id}/09-review.md")
                     if os.path.isfile(_review_path) or os.path.isfile(_review_path2):
                         passed, reason = True, "Review file exists (file-based approval)"
                     else: