Worktree-per-task workflow: retire working-branch, fix check-dotfiles' checkout resolution

[tlockney]

Why

Asked to park ~/src/personal/dotfiles back on working-branch and establish a convention where future work happens in its own worktree on its own branch. Dogfooding that convention — this PR was built in a worktree — immediately broke three things.

What dogfooding found

1. just check reported "All 0 checks passed" from a worktree.

The recipe called ~/bin/check-dotfiles, which resolves its repo root from its own location — so from a worktree it scanned $HOME, not the worktree. $HOME is the yadm main worktree and has no .git directory of its own, so git ls-files matched nothing and every section trivially passed. A green run that checked nothing is the worst result this script can produce, and my own Justfile recipe walked straight into it.

Fixed by using ./bin/check-dotfiles. The other recipes keep ~/bin because they act on the live system rather than a checkout.

2. Nothing prevented that from recurring silently.

The script now refuses to run outside a git checkout, and refuses to report success when it matched zero files. Both verified:

$ /tmp/notarepo/bin/check-dotfiles syntax
Error: /tmp/notarepo is not a git checkout; refusing to report a pass over nothing

$ ./bin/check-dotfiles syntax        # git repo, nothing tracked
Error: no files were checked -- expected at least one match in /tmp/emptyrepo

3. Every new worktree is broken for mise-shimmed tools.

This repo ships .config/mise/config.toml, so mise treats any checkout as a project config and refuses to run until that exact path is trusted. A freshly created worktree is untrusted, so python3, node, uvx — all mise shims — exit 1 instead of running. This surfaced as 73 "parse error" failures against config files that are entirely valid.

That is not a problem with this script; it affects anything you run in a new worktree. It is now documented as a required step, and the script probes for it:

Error: python3 will not run in .../worktree-conventions:
mise ERROR Config files in .../.config/mise/config.toml are not trusted.
  If that mentions mise, this checkout is untrusted. Run: mise trust

The documented convention

~/src/personal/dotfiles stays parked on working-branch as a stable, current checkout and is not where edits happen. Each task gets ../dotfiles-worktrees/<task> on its own branch off origin/main, trusted with mise trust, validated with just check, then removed when merged.

The README also records two traps hit during this session: never git checkout main in a linked worktree (main belongs to the $HOME worktree), and never a bare git commit after a git rm — it commits the whole index and will sweep unrelated staged changes into your commit, which is exactly what happened to the lint.yml deletion in #28 before I redid those commits.

Verification

From the worktree, after mise trust:

syntax   All 39 checks passed
configs  All 77 checks passed
shell    All 3 checks passed
emacs    All 1 checks passed

configs is 77 locally vs 97 in CI because the runner has luac and this Mac does not — reported as SKIP, not a silent pass.