Protect registered checkouts and Git storage inside removal targets - #4463

Removing a checkout must preserve registered checkouts and this repository's Git storage inside it, including with --force. Put the final containment, captured-registration, lock, and cancellation gates at both actual mutation boundaries: trash staging and direct Git removal. Registry synchronization keeps the decisive cleanliness and topology checks clear of concurrent teardown, with no duplicate scanner.

If staging fails, a private Rust worker preserves background execution while using the same guarded removal owner. Native checkout and captured-registration paths travel as argv; typed branch intent uses the existing detached stdin transport. The owner rechecks the captured registration after its registry wait, then checks containment, locks, and cancellation before deletion. This replaces the unchecked raw-Git child and separate branch-deletion tail. Noncurrent prune fallback remains synchronous so its summary reports an observed result; current-checkout removal can release its working directory before the worker deletes it.

The worker also owns the deferred post-remove event. The parent renders the already approved hook plan without dispatching it and sends that frozen batch through the same transport. After confirmed removal, the worker finishes the branch decision and dispatches post-remove through the existing hook runner, even if branch deletion failed. A refused removal starts no post-remove pipeline. An interrupted branch operation preserves its interruption without starting hooks; shared dispatch checks cancellation before announcing and before each new pipeline. Post-switch remains with the parent's actual directory change. The worker never selects or approves hooks again, and failed preparation cannot flush a partial batch through Drop.

Includes the registration-identity work from #4454 and recovery transactions from #4459. Landing order is #4454, then #4459, then this PR. The final staging checks, checkout move, and atomic unregister share one registry write lock; failed unregister restores the checkout or retains both payloads if restoration is blocked. Disposal preparation runs after releasing the lock. A committed transaction whose cleanup is deferred remains a successful removal and never falls through to another deletion attempt.

Also reuses the canonical separate-Git-store discovery correction reviewed in #4461, after reproducing an actual containment escape. An unknown primary checkout now requires Git repair rather than supplying a guessed root. No user-facing command, flag, or configuration is added. Deferred branch outcomes remain meaningful for delegated deletion; later worker failures go to its log, and preparation failures do not claim removal already completed.

Review scope: the whole stack is 47 files, +3,991/-1,319. The incremental diff after #4459 is 34 files, +2,335/-931. Most added lines are regression tests and captured output; most production churn is in the shared removal and output owners, including replacing the unchecked fallback with the native worker. The final test-only repair adds five actual deferred-output goldens (394 lines) while preserving the existing staged goldens.

Validation: the unchanged production code passed the full 5,507-test project gate (one skipped), plus formatting, Clippy, docs, doctests, and lockfile checks. All 253 focused combined safety tests and 12 final cancellation-contract tests pass, as does the 18-page documentation build. The subsequent test-only follow-up passes all 10 staged/deferred hook cases and seven docs/snapshot checks. It exercises deferred removal on every platform, verifies actual cleanup/notification/merge hook logs and checkout removal, and retains staged coverage on Unix. Tests run the actual worker to check refusal without hook dispatch, captured branch tips and targets, post-remove after checkout and branch deletion, post-remove despite ordinary branch failure, and approved hooks surviving config mutation. Native SIGTERM tests cover worker, public foreground, and public background removal; cancellation starts no new hook pipelines. Fallback fixtures occupy the transaction reservation or staging root to force failure before checkout movement on all platforms. Independent review of the combined source and test repairs found no remaining actionable issues.

Final-head CI: all Windows, macOS, Linux, advisory affected tests, lint, docs, features, and coverage-workflow jobs pass. Codecov project passes at 98.60%; mandatory patch coverage remains below target, 97.62% against 98.62%. The completed current-head review confirms the hook-ordering fix and no new actionable issue; it deliberately retains the existing maintainer deletion-safety hold without posting a duplicate review. No target merge has been performed.

This was written by Codex on behalf of max-sixty