feat(daemon): add MULTICA_POST_CHECKOUT_HOOK for repo checkout extensibility

[medi1-3]

Summary

Adds an opt-in MULTICA_POST_CHECKOUT_HOOK environment variable. When set to an executable path, the daemon runs that script after every successful worktree create or update in repocache.CreateWorktree. The hook receives the worktree as CWD and the following env vars: MULTICA_WORKTREE_PATH, MULTICA_REPO_URL, MULTICA_REPO_NAME, MULTICA_BRANCH.

Why

Self-hosted deployments often need to materialize per-repo state into the worktree immediately after checkout — typical examples:

• Per-repo secret injection — write .env from an external secret store (Infisical, Vault, Doppler) so dotenv-based tooling (pnpm dev, pytest, python-dotenv) just works once the agent cds in.
• Per-repo bootstrap — pnpm install, python -m venv .venv, poetry install, etc.
• Per-repo skill files — drop project-specific skill markdown into the worktree.

Today, agents must remember to run such steps manually after multica repo checkout. A daemon-level hook makes the bootstrap step transparent and reliable.

Design

• Fire-and-log: failures are warnings, not errors. Checkout always succeeds for the agent regardless of hook outcome.
• 30s timeout via context.WithTimeout so a hung hook cannot stall task spawning.
• Defensive validation: missing path / directory / non-executable file are skipped with a warning rather than executed or panicked.
• No new dependency on Config. Read directly via os.Getenv, matching the gitEnv pattern already used in this file.
• Idempotent at the daemon level: the hook runs after both fresh worktree creation AND worktree update — so on a reused environment, the hook gets a chance to refresh whatever it manages.

Behavior matrix

MULTICA_POST_CHECKOUT_HOOK	Result
Unset / empty	No-op (default behavior unchanged)
Path to executable file	Hook runs; output logged at INFO if exit 0, WARN with stderr if non-zero
Path to missing file	WARN + skip
Path to directory	WARN + skip
Path to non-executable file	WARN + skip
Hook exits non-zero	WARN + checkout still succeeds
Hook exceeds 30s	Killed via context cancellation + WARN

Test plan

• Unit tests cover: no-op (unset), happy path (env vars + CWD reach the hook), missing path, non-executable file, non-zero exit. All in cache_test.go.
• go test ./internal/daemon/repocache/ — passes
• go test ./internal/daemon/... — passes (no regression in sibling packages)
• Manual e2e on a self-hosted instance with a real hook that writes a .env file — pending (will report in a comment).

Compatibility

Fully backwards compatible. The env var defaults to unset, in which case behavior is identical to today's.

[vercel]

@medi1-3 is attempting to deploy a commit to the IndexLabs Team on Vercel.

A member of the Team first needs to authorize it.