Fix generated path handling for OpenLoops route worktrees

[andrei-hasna]

Summary

• add shared Git project path helper that preserves repo subdirectory routing but rejects generated .tmp/.bun-cache/node_modules/dist paths inside a checkout
• apply the helper to route throttling and workflow template worktree validation
• make local and remote required-worktree preparation fail closed unless repoRoot is the actual Git top-level
• keep boundary scans from traversing generated task caches and allow hygiene repo naming for managed worktrees

Validation

• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun run typecheck
• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun test src/lib/git-project.test.ts src/no-private-cloud-boundary.test.ts src/cli/index.test.ts src/lib/hygiene.test.ts src/lib/executor.test.ts src/lib/templates.test.ts (270 pass, 0 fail)
• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun run test:boundary
• BUN_INSTALL_CACHE_DIR=$PWD/.bun-cache BUN_RUNTIME_TRANSPILER_CACHE_PATH=$PWD/.bun-cache/transpiler TMPDIR=$PWD/.tmp bun test (697 pass, 15 skip, 0 fail)
• git diff --cached --check
• staged credential-pattern scan

Review

Independent adversarial reviewer found a nested generated-dir gap; fixed by scanning every relative path segment and adding src/lib/git-project.test.ts coverage for repo/packages/sdk/.tmp and .bun-cache.

Task: e67e4e71-d27b-40e2-81e9-a7362e9e5cc7

[andrei-hasna]

OpenLoops worker review is blocking merge for now.

Independent adversarial reviewer found a managed-worktree hygiene bug in this PR:

• src/lib/hygiene.ts now allows ~/.hasna/loops/worktrees/* cwd values to become repo-scoped, but repoSlugFromCwd() still returns slugify(basename(cwd)).
• OpenLoops templates create managed worktree paths as //[/relativeCwd], so a task worktree gets a run-specific repo slug instead of the repository slug.
• Local reproduction on the PR merge tree: buildNameHygieneReport() for cwd /home/hasna/.hasna/loops/worktrees/open-loops/8d34d54a-3e60-4dc2-84ba-7ea693727c32-d4976308 produced scopeSlug "8d34d54a-3e60-4dc2-84ba-7ea693727c32-d4976308" and newName "repo-8d34d54a-3e60-4dc2-84ba-7ea693727c32-d4976308-lint", where the expected repo scope would be open-loops.

Required before merge: derive the repo slug from the managed worktree repo segment, or otherwise from the git top-level repository identity, for ~/.hasna/loops/worktrees//[/relativeCwd], and add focused hygiene test coverage for managed worktree cwd paths.

Validation otherwise completed on a local merge of origin/main ff62f37 + PR head 07c500d: focused tests passed, typecheck passed, boundary scan passed, build passed, and the full suite passed with bun test --timeout=15000 (713 pass, 15 skip). The default local bun test run has a separate 5s timeout in existing route tests that reproduces on unmodified origin/main or under local load, so it is recorded as base/environment timing rather than this PR regression.