Enforce always-isolated build workspaces in gate lanes (D preferred, C fallback)

[svelderrainruiz]

Summary

Enforce always-isolated build workspaces for gate/build lanes to prevent persistent repo dirtiness from LabVIEW build activity.

Policy

• mode: always-isolated
• primary strategy: git-worktree
• fallback strategy: detached-clone
• windows root selection: prefer D:\dev, fallback C:\dev
• cleanup: always
• scope: windows host release gate, windows container parity host preflight, linux gate windows prerequisites, local exercise
• published installer defaults remain unchanged (CI-only selector)

Motivation

Observed persistent repo mutation during host build activity (example: lv_icon_editor.lvproj dirtied in canonical path).

Acceptance Criteria

1. No gate/build lane performs in-place build in persistent canonical repo paths.
2. C/D deterministic selector is enforced by contract tests.
3. Worktree fallback to detached clone is deterministic and reported.
4. Cleanup runs in always() and removes isolated roots after artifact upload.
5. Windows and Linux gate contracts remain green with no pwsh/NIPM regressions.
6. Evidence artifacts include isolation/provision metadata and pre/post git status snapshots.

Links

• Related: Contract follow-up: NSIS host=LV2020 only + .lvcontainer-derived docker versioning/job metadata #35
• Related blocker track: fix: harden windows gate image compatibility and troubleshooting contract #29