[BUG] Golden-repo per-worker cache not invalidated on cross-node mutation (stale-positive; follow-up to #1314)

[jsbattig]

Bug Description

Follow-up to #1314. GoldenRepoManager.golden_repos is a per-worker read cache. After #1314 it uses reload-on-miss (a repo absent from the cache is fetched from the shared DB), which fixes the cross-worker "not found" MISS bug. But the cache is never invalidated on a cross-node mutation (branch change, temporal-option change, or removal on another node). So a worker that has a repo cached can act on a STALE POSITIVE until it restarts.

Impact / Scope (bounded)

Per code review of #1314, the residual is bounded and non-corrupting:

• Presence-only checks (add/register/remove/exists): no material harm; removed-elsewhere fails loud.
• get_actual_repo_path/add_indexes/get_golden_repo_indexes read clone_path (immutable per alias); removed-elsewhere fails loud on the shared FS.
• The ONLY field-value staleness with an incorrect outcome: change_branch/change_branch_async read a stale cached default_branch, producing a false "already on branch" no-op or a redundant idempotent reindex — no data corruption.
• Self-healing on worker restart. This staleness is pre-existing (predates [BUG] Golden-repo management ops use per-worker in-memory dict -> intermittent 'not found' in multi-worker cluster (Cluster-Aware-State violation) #1314); [BUG] Golden-repo management ops use per-worker in-memory dict -> intermittent 'not found' in multi-worker cluster (Cluster-Aware-State violation) #1314 neither introduced nor worsened it in kind.

Expected Behavior

Cross-node mutations (branch change / temporal-option change / removal) should be visible to all workers without a restart.

Remediation Options

(a) Have mutation-path ops (change_branch, add_indexes_to_golden_repo, get_golden_repo_indexes) read the backend authoritatively instead of trusting a cached positive; or (b) add a lightweight version/invalidation signal (e.g. a DB-backed generation counter checked per request, or invalidate-on-remove/change broadcast). Keep the reload-on-miss cache for the common read case.

Severity

priority-3. Rare, non-corrupting, self-healing; not a blocker. Tracked separately from the #1314 MISS fix per code-review recommendation.