feat(server): integrate Riftri worktree storage

[Kinfe123]

Problem

Every T3 worktree currently materializes another full checkout. This fork uses Riftri's native copy-on-write storage where supported while retaining real Git linked worktrees and the existing project/thread model.

Implementation

• Integrate the shared server Git driver, not prompts or shell hooks. Default creation to auto; retain explicit git and strict riftri modes.
• Preserve Git reference selection, branch safety, checkout hooks, conflict reasons, worktree-claim callbacks, and submodule setup. Ordinary-Git fallback is allowed only before mutation for explicitly unsupported checkouts or Git's remote-branch guessing. Failed or uncertain native operations are never retried as full checkouts.
• Use exact native ownership and journaled removal/prune, including after restart or switching to Git mode. Force remains explicit.
• Restore persisted Linux mount-backed worktrees before provider recovery and background work. Batch distinct paths, repair recoverable states, and verify readiness again. An unsafe workspace blocks its own Git operations, provider sessions, terminals, and file writes while healthy projects remain usable. Retry clears the block only after successful inspection.
• Ship published riftri@0.6.3 and its native optional dependency in Node, standalone CLI, and Electron distributions. Keep native packages external to bundles and unpack executables from ASAR.
• Activate the fork's CI with GitHub-hosted runners. Publishing/deployment workflows remain disabled. Add required real APFS/OverlayFS tests, physical-allocation measurements, and complete desktop/CLI artifact checks.

Verified

All 19 jobs passed on the exact PR head 4daf351d59112728e2cdf4410e6593c2aab31715: CI run. This includes lint, full typecheck, web tests, all six server shards, other workspace tests, native storage on both platforms, and the required aggregate check. Repository-wide checks ran in CI, not locally, per the contributor guide.

• Native tests verify clean Git status and exact HEAD, base reuse, private-write isolation, dirty-removal refusal, reference/conflict compatibility, restart behavior, cleanup, and GC.
• The Linux lane uses real OverlayFS in an isolated mount namespace. It unmounts an owned view and changes its journal boot identity to simulate reboot, restores the private edit through T3 startup, then checks a foreign bind mount is preserved and only its workspace is blocked.
• The complete unsigned Linux desktop archive is built without publishing and extracted outside the checkout. Electron loads its server and executes its own unpacked Riftri dependency; assertions prevent checkout/global dependencies from satisfying the probe.
• The standalone Linux CLI archive is built with the release SEA runtime, extracted, and tested with no Node on PATH. --version passes and its server returns HTTP 200 from a disposable home. No live T3 data is used.
• Local focused verification also passed: 119 Git-manager tests, 12 project-contract tests, workspace/provider/terminal guards, targeted typecheck, and the released-binary APFS allocation test. Only pre-existing lint warnings remain.
• The signed Riftri v0.6.3 release passed its 12-job release workflow. All nine exact npm packages have verified SLSA provenance; release archives passed SHA-256 checks and fresh-install lifecycle tests.

Measured benefit and tradeoff

These are real physical allocation measurements through T3's Git driver and the published release binary, using dedicated disk images. Three worktrees; a 32 MiB incompressible payload plus 257 text files; the first immutable base is included. This is tracked-file storage, not shared dependency installs or build caches.

Backend	Ordinary Git bytes	Riftri bytes, including base	Less allocation
APFS	107,462,656	36,212,736	66.30%
OverlayFS	107,216,896	36,036,608	66.39%

Creation was slower, not faster. In the same CI fixture, cold/cached/cached creation took 507/351/359 ms with Riftri versus 162/125/120 ms with Git on macOS, and 366/292/202 ms versus 85/68/69 ms on Linux. These are single-run diagnostics, not latency guarantees; CI retains the JSON reports and does not use a flaky timing threshold. The docs explain this tradeoff and the Git opt-out.

An earlier real-source APFS experiment using the Riftri repository also saved 64.77% physical allocation across three views, but used a debug binary and is not a release-speed claim. T3's own submodule-containing tree intentionally uses ordinary-Git fallback, not optimized creation.

Supporting Riftri PRs: assistant-ui/riftri#677, pingdotgg#678, pingdotgg#679, pingdotgg#681, pingdotgg#682, pingdotgg#683, and pingdotgg#684 (squash-merged).

Model: GPT-5. Harness: Codex.