Guard Worktrees in the Windows preview

[coneilen]

Summary

Guard every Windows Worktrees action in early-preview release-candidate builds before synchronous inspection or stale reclaim/policy state can run. Normal developer and local-development builds retain the existing Worktrees implementation.

Part of #560. This does not close #560, change #587's harness, implement the speculative async fix, or alter the superseded 0.1.78-beta1 tag/artifacts.

Changes

• Add one centralized guardWorktreesPreview decision point that clears in-memory Worktrees state and exposes the exact status Worktrees are deferred for this preview.
• Funnel inspection, header/overview/context/UIA/keyboard/command dispatch, selection, reclaim, reveal, and policy actions through guarded product entry methods; guarded inspection call count remains zero.
• Add a build-time -Dworktrees-deferred option that defaults to false; ordinary release-candidate packaging sets it to true, local packages set it to false, and packaging verifies the compiled binary state.
• Record the compiled preview policy in package metadata and add focused route/package contracts without changing the Bound UIA Worktrees gate traversal #587 files.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\WorktreePreviewGuard.Tests.ps1 -> RED: production Worktrees routes do not expose the required preview deferral message
GREEN: pwsh -NoProfile -File Tools\windows\Tests\WorktreePreviewGuard.Tests.ps1 -> Worktree preview guard contracts: 41 passed
REGRESSION: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task windows-shell -ShellPart unit -SkipTrayLive -> 52/52 sections and 735/735 tests passed

• Focused App executable filter: preview Worktrees guard -> 1/1 passed with inspection attempt count 0 and exact deferred text.
• Full App Zig root -> 778/778 passed before the registered runner pass.
• ReleaseSafe shell build with -Dworktrees-deferred=true -> binary reported version 0.0.0-preview-guard and Worktrees state deferred.
• pwsh -NoProfile -File Tools\windows\Tests\Packaging.Tests.ps1 -> passed, including release-candidate/local flag semantics and package lifecycle.
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task packaging -PackagingPart real -> passed.
• git diff --check origin/main...HEAD -> passed.
• Native Worktrees UIA responsiveness observation: NotExecuted because this session does not own an isolated desktop; no native responsiveness or parity claim is made.
• The full local packaging contracts aggregate was not used as green evidence because its unchanged standalone harness rejects WinPS 5.1 CLIXML rendering of the expected invalid-command diagnostic on this host. The real packaging validation above passed.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure