fix(goals): harden line change accounting

[andrei-hasna]

Summary

• prevent automatic Git worktree snapshots from executing configured clean or process filters, including included config, while preserving line counts
• persist signed line-change deltas atomically so concurrent linked worktrees add to the same goal without overwriting each other
• defer conservative MaybeMutatesWorktree scans until turn finalization, capture confirmed apply_patch mutations immediately, and retry same-CWD lease acquisition on a later tool start in the same turn
• add real test_codex lifecycle coverage, app-server LOC preservation coverage, MCP readOnlyHint signal coverage, and exact argument comments in the owned goals runtime file

Verification

• Blacksmith Testbox run 30343158545 passed at exact head 4aba804 in 14m18s: https://github.com/hasna/codewith/actions/runs/30343158545
• rebased onto exact main e10c087
• focused local git-utils, core, goal-extension, state, and app-server tests passed
• just check-fast -p codex-extension-api passed
• just fmt passed
• cargo fix --workspace --all-targets --allow-dirty passed
• just fix -p codex-git-utils -p codex-extension-api -p codex-core -p codex-goal-extension -p codex-state -p codex-app-server passed
• git diff --check passed
• staged and origin/main..HEAD gitleaks scans passed
• cargo shear --deny-warnings passed locally; hosted cargo shear passed on exact head 4aba804
• targeted Bazel argument-comment lint passed for //codex-rs/ext/goal:goal and //codex-rs/ext/goal:goal-accounting-test; hosted Linux and Windows argument-comment jobs passed on the exact head
• standard PR CI completed green at exact head 4aba804: 25 passed, 0 failed, 0 pending
• the full local argument-comment lint reported only unrelated current-main app-server diagnostics; no owned goal or state diagnostics remain

Changed files

• codex-rs/app-server/tests/suite/v2/goal_loc_lifecycle.rs
• codex-rs/app-server/tests/suite/v2/mod.rs
• codex-rs/app-server/tests/suite/v2/thread_resume.rs
• codex-rs/core/src/tools/handlers/apply_patch.rs
• codex-rs/core/src/tools/handlers/mcp.rs
• codex-rs/core/src/tools/registry.rs
• codex-rs/core/src/tools/registry_tests.rs
• codex-rs/ext/extension-api/src/contributors/tool_lifecycle.rs
• codex-rs/ext/goal/src/accounting.rs
• codex-rs/ext/goal/src/extension.rs
• codex-rs/ext/goal/src/line_changes.rs
• codex-rs/ext/goal/src/runtime.rs
• codex-rs/ext/goal/src/tool.rs
• codex-rs/ext/goal/tests/accounting.rs
• codex-rs/ext/goal/tests/goal_extension_backend.rs
• codex-rs/git-utils/src/worktree_snapshot.rs
• codex-rs/state/src/runtime/goals.rs

Tradeoffs

• MaybeMutatesWorktree tools intentionally avoid intermediate snapshots and rely on turn-stop/abort capture; confirmed direct worktree mutators still capture immediately.
• A same-CWD lease loser begins attribution only after it successfully reacquires the lease, so edits made before reacquisition are intentionally omitted instead of being double-attributed.
• Snapshot failures omit LOC attribution for that turn rather than retrying an unavailable snapshot repeatedly or risking duplicate ownership.
• The hosted repository-wide argument-comment gate is green on Linux and Windows; the local full-lint diagnostics were confined to explicitly excluded current-main app-server files.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}