[growlf]

Closes #450

What

bin/check-worktree.sh reported "in the primary checkout" from inside every linked worktree, so the guard's only meaningful signal — the primary checkout having drifted off main — was buried under noise that fired on every legitimate commit.

Root cause

REPO_ROOT was derived from the script's own location and reused as PRIMARY_PATH, then compared against each entry of git worktree list. That list always contains the worktree the caller is standing in, so the comparison matched unconditionally and IS_PRIMARY=1 was guaranteed.

The fix compares git rev-parse --absolute-git-dir with --git-common-dir: identical only in the primary checkout, distinct (<common>/worktrees/<name>) in a linked worktree. The word-splitting for line in $WORKTREE_LIST loop goes away with it, so checkout paths containing spaces no longer break detection.

A second defect the new tests found

GREEN was never defined in the script's colour block, so the success path — OK: In worktree '<path>' on branch '<branch>' — died under set -u with GREEN: unbound variable, exit 1. It had never been reached, because the broken detector always took the warning branch. One bug was hiding the other; fixing detection alone would have turned "false warning" into "fails on every legitimate commit".

Tests

New tests/test_check_worktree.py, 8 cases built on real repositories (stubbing git would have reproduced the bug's assumptions rather than catching them):

Situation	Expected
worktree, feature branch	exit 0, no "primary checkout"
worktree path containing a space	resolves correctly
worktree, run from a subdirectory	still detected as a worktree
primary, main	exit 1, refusal
primary, main, --allow-main	exit 0, override acknowledged
primary, feature branch	exit 0, warning (the genuine case)
worktree on main	exit 0, worktree-on-main warning
outside a git repository	exit 1, clear error

Full suite: 1716 passed, 1 skipped.

Also in this branch

Two commits carried over from session work that would otherwise have been left uncommitted in the primary checkout — which is the very state this script exists to prevent:

• docs(kb) — two findings that cost real diagnostic time: a Frappe site 500ing because its DB user was granted for a single container IP, and the Bitwarden CLI answering bw list from a local cache while locked, which can turn "not in the vault" into a confidently wrong answer. Container addresses use RFC 5737 documentation ranges.
• fix(ansible) — render handler: redirect routes through their own branch in the Caddyfile template. No rendered-output change: the live deployed config is byte-identical to this template's render.

Deliberately not included: uncommitted edits to bin/bwunlock.sh in the primary checkout, which belong to another session still in flight there.