fix(app): kill processes inside a worktree before removing it

[chphch]

Removing a git worktree from the app (removeWorktree in sources/utils/worktree.ts) ran git worktree remove --force while a happy session could still be cwd'd inside that worktree — most often a session that got orphaned when its daemon restarted, so the daemon-driven stop never reached it. --force then deleted the directory out from under the live process, which kept its server socket open and re-reported the session as active on every heartbeat. The session became impossible to archive from the app: each active: false was instantly overwritten by the orphan's next heartbeat. This change stops any process whose working directory is inside the worktree (SIGTERM, best-effort) before the directory is removed.

The new killProcessesInWorktree is portable across the host OS (Linux reads /proc/<pid>/cwd, macOS falls back to lsof), canonicalises the worktree path (pwd -P) so a symlinked parent still matches, and anchors the match to the worktree dir or a subdir of it so a sibling that merely shares a name prefix is never touched. It resolves lsof by absolute path so a stripped PATH still finds it, and never blocks the removal if anything goes wrong.

Proof

Ran the exact killProcessesInWorktree shell — the macOS/lsof branch — verbatim against a real process tree, handing it a symlinked worktree path to exercise canonicalisation:

• process inside the worktree → killed
• process in a subdirectory of the worktree → killed
• process in a prefix-sibling dir (wt-sibling) → spared (anchoring — a shared name prefix is not a match)
• the symlinked path …/link/wt was canonicalised to …/real/wt, so lsof's physical paths matched
• lsof was not on PATH, so the /usr/sbin/lsof fallback was exercised

removeWorktree calls this immediately before git worktree remove --force (see the diff), so the orphaned session is shut down cleanly and can be archived from the app as expected.