fix(hooks): unify gate-marker root across linked worktrees, isolate palette tests from repo state

[SUaDtL]

Summary

Closes two "works on a clean checkout, breaks in a real environment" defects that have repeatedly polluted this repo's local test runs.

#604 — gate-marker root mismatch in a linked worktree

security-pass.py/migration-pass.py (invoked bare via a Bash tool call, no CLAUDE_PROJECT_DIR in that shell) and the H-09b/H-10b/H-14 commit guards (a hook subprocess whose CLAUDE_PROJECT_DIR names the main checkout) resolved different roots for .codearbiter/.markers/ inside a linked git worktree — a legitimately-recorded gate pass was invisible to the guard.

Fix: a new hostapi.Host.marker_root() seam. git_worktree_main_root(root) escalates an already-resolved project_root() answer to the MAIN checkout only when that root is itself a linked worktree's own checkout (distinguished from a submodule via the gitdir: pointer's .git/worktrees/ segment). Wired into both producers (security-pass.py, migration-pass.py) for the marker WRITE, and both guard checks (_check_h09b_h10b_crypto_secret, _check_h14_migration) for the marker READ — via _marker_root() in _bashguardlib.py. Deliberately not wired into project_root() itself: security-pass.py's diff SCAN must stay bound to the worktree's own tree (the issue's own warning — binding digests to the wrong tree would review lines nobody staged). git_toplevel's git rev-parse mechanism is unchanged, per the board history caution (bug #125, symlink/8.3 canonicalization) — the fix makes the two callers agree through the existing seam rather than replacing it.

Also fixes the 10-test pre-existing failure family in test_git_hooks.py/test_repo_resolution.py that fires whenever the suite itself runs from inside a linked worktree: _githooks's own __file__ resolves to an ephemeral path, which is_ephemeral_path (#441/ADR-0014) correctly refuses to register into a fixture's shared drop-in dir. Fixtures now resolve the enforcer path from a durable_plugin_copy (the #442 fix's existing pattern) instead of the live (possibly-ephemeral) checkout.

Before/after, run inside a real linked worktree of this repo (dirty local state):

	before	after
test_git_hooks.py + test_repo_resolution.py	10 failed	0 failed
plugins/ca/hooks/tests (full suite)	10 failed, 1301 passed	0 failed, 1339 passed

Proven end-to-end with a real git worktree add fixture (TestGateMarkerAgreesAcrossLinkedWorktree in test_repo_resolution.py): a marker written by security-pass.py (bare, no CLAUDE_PROJECT_DIR) lands at the main checkout, not the worktree; pre-bash.py's H-09b guard honors it; and the guard still blocks with no recorded pass (no-fail-open converse).

#552 — palette-compatibility tests read real repo state

test_colorlib.py's palette-compatibility tests render the live statusline against the real repository when a subprocess call has no explicit cwd — project_root() falls back to a git-toplevel climb from the test runner's own cwd, so a maintainer's own accumulated .codearbiter/ audit trail (task counts, override counts, gate-event rows) could intermittently drop a required custom-palette color from the assertion window.

Fix: pinned the state-sensitive subprocess render to an isolated temp dir (no .git/.codearbiter reachable), and added test_custom_palette_survives_arbitrary_appended_codearbiter_state — a new test that builds its own .codearbiter/ fixture, appends 40 override rows, 200 gate-event rows, several in-flight tasks, and an unresolved open question (the exact adversarial shape #552 describes accumulating over a repo's lifetime), and proves the palette-completeness assertion still holds.

Mutation proofs

• hostapi.git_worktree_main_root: forced it to return None unconditionally → GitWorktreeMainRootTests, MarkerRootTests, and both TestGateMarkerAgreesAcrossLinkedWorktree positive-proof tests went red with the exact expected assertion failures; the no-fail-open converse test stayed green. Restored, re-verified green, re-synced.
• _githooks's durable-copy fixture patch: disabled self._enforcer_patch.start() in both test files → the exact same 10 pre-existing failures reproduced with identical messages. Restored, re-verified green.
• _colorlib._read_custom: forced it to return None unconditionally → the new adversarial-state test failed with "missing custom colors" for all 7 required colors. Restored, re-synced, re-verified green.

Version advance

ca 2.11.9 → 2.11.10, ca-codex 0.4.8 → 0.4.9, ca-pi 0.2.8 → 0.2.9 (root package.json regenerated). All landed inside this PR's rebase onto the latest origin/main (which had independently advanced to 2.11.9/0.4.8/0.2.8 via #614/#615 while this branch was in flight) — the target versions in this PR were already exactly one patch above that new base, so no further bump was needed after resolving the conflict.

Deviations from plan

• The H-09b crypto/secret gate on this PR's own commit hit a genuinely stale local marketplace-cache install (~/.claude/plugins/cache/codearbiter/ca/2.10.0) registered as the git-level .git/hooks/pre-commit enforcer — an environment fact unrelated to this fix (predates it, would recur on any PR). Resolved by running the same stale security-pass.py (not this branch's fixed copy) so its root resolution matched what the stale enforcer checks — no gate was bypassed; /ca:override was considered and rejected since it required fabricating user acknowledgement for a security-critical stop that a non-bypass fix cleanly resolved instead.

Closes #604
Closes #552

https://claude.ai/code/session_01QjJeSbcwPHwMmd6CEZeagB

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f45cd18a-01e0-4fa7-9317-9254430588d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}