worktree isolation is per-spawn, so dependent workflow stages cannot see each other's edits

[justrach]

Problem

isolation:"worktree" is scoped to a single subagent spawn. Every task calls runSub independently and gets its own worktree branched from HEAD; only the previous stage's text is forwarded ({{prev}}).

That is correct for parallel independent editors. It is wrong for every dependent chain the shape catalog describes — transform -> verify, implement -> review:

• The later stage reads the original source, not the implementation it is supposed to verify.
• Dirty changes stay stranded in a retained agent worktree.
• If an agent commits, cleanup sees a clean worktree and can remove both the worktree and the temp branch without delivering the commit.
• Net effect: a workflow can report a successful implement + review while the requested changes never reach the caller tree.

Found by running ultracode review src/shapes.zig against the new shape catalog — the catalog reviewing its own file.

Already done

The immediate harm was in the guidance: the catalog told the model to set isolation:"worktree" on file-editing tasks generally. That is fixed on feat/293-ultracode-shapes — the note now scopes it to tasks editing IN PARALLEL within one phase whose edits nothing downstream reads, and explicitly forbids it on dependent chains. A test pins the new wording and the absence of the old.

So today the model is told not to walk into this. The engine still cannot express the thing that would actually be useful.

What is wanted

Isolation scoped to the workflow, or to a pipeline item, rather than to one spawn:

• One worktree per pipeline item, reused by every stage of that item, so verify sees what transform wrote while items stay isolated from each other.
• For phases, one worktree shared by a dependent chain.
• Explicit delivery of the resulting changes back to the caller tree at the end, with a reported path or merge.
• Never delete a temp branch whose commits have not been integrated or otherwise preserved. Cleanup currently treats "clean worktree" as "nothing to keep", which is exactly wrong once the agent has committed.

Relevant code: src/workflow.zig:120-141, src/subagent_run.zig:213-226,280-303, src/agent_worktree.zig:31-74.

[justrach]

The harmful guidance half is already fixed in #293 (d09f39f) — the catalog no longer tells dependent chains to isolate. This issue is the remaining engine work: making a worktree span a workflow/pipeline item and delivering its changes.