Keep worktree planning free of Git fetch mutations

[chubes4]

Problem

workspace worktree plan is presented as the non-mutating half of DMC's digest-addressed plan/apply contract, but planning invokes the staleness probe's Git fetch. This updates primary repository remote refs and fetch metadata while the caller expects preview semantics.

That makes Homeboy Cook preview operationally surprising: a supposedly non-mutating preview can perform network I/O, block on remote/proxy state, alter Git metadata, and produce a plan whose timing depends on transport availability. It also makes preview materially slower and encourages agents to bypass planning with direct worktree creation.

Acceptance criteria

• Define preview mutation semantics explicitly: no worktree/filesystem creation and no Git ref or config mutation.
• Planning reads already-verified freshness evidence or returns a typed freshness_refresh_required result with one exact refresh command.
• Any optional refresh is a separate explicit operation whose resulting identity/digest is bound into the subsequent plan.
• Repeated unchanged plans are deterministic and require no network access.
• Apply rejects stale freshness, remote, capacity, ownership, or destination evidence with typed reasons.
• Tests prove Git refs, reflogs, config, index, worktree inventory, and filesystem state are unchanged by plan.

Related

• Expose a non-mutating worktree intent plan for orchestration providers #1091

AI assistance

OpenAI GPT-5.6 Sol via OpenCode audited the current worktree plan path and drafted this issue. Chris Huber remains responsible for the report.