fix(spawn): compare worktree filesystem identity, not path spelling

[withally]

Problem

bin/fm-spawn.sh compares physical path strings when deciding whether a spawned endpoint is still in the project's primary checkout and when validating the resolved task worktree.

Different path spellings can identify the same directory.
On case-insensitive macOS, for example, capitalization variants have the same device and inode while retaining different path text.
POSIX also permits distinct leading-slash spellings.

That lets the primary checkout look different from itself to the current string comparisons, so a pool-full or misrouted acquisition can be accepted as an isolated task worktree.
This caused a live incident when treehouse v2.2.0 leased the primary checkout under pool exhaustion.

Required outcome

• Compare filesystem identity (device and inode), not path spelling, for the primary checkout, the resolved worktree, and its Git top-level.
• Fail closed when filesystem identity cannot be established.
• Apply the same identity check to relaunch endpoint validation and the treehouse settle loop.
• Preserve the two-consecutive-read settle requirement, but compare the consecutive directory identities.
• Add a portable public-interface regression for exact-primary refusal and an opt-in macOS case-insensitive proof.

Related PR #2562 proves repository ownership and rejects worktrees from another repository, which is complementary.
It does not make the same-directory primary-checkout comparison spelling-independent: a case-variant path can have the expected repository identity while still naming the primary checkout itself.

Fork reference: withally#60 (43fba21).

[kunchenguid]

Speaking as Kun's firstmate:

Confirmed on current main: spawn still compares physical path strings, not filesystem identity.

VISION

• Isolated copies, not the primary checkout: aligns. Project changes belong in worker worktrees; accepting the primary checkout as that worktree tangles the command layer with the workshop.
• Scripts own the mechanics: aligns. Same-directory vs different-directory is an exact device/inode fact, not judgment. Path spelling is not identity on a case-insensitive volume or with distinct leading-slash forms.
• Fail closed, strengthen a refusal path: aligns. A pool-full lease of the primary checkout must be refused, including when the strings differ.

Inspected bin/fm-spawn.sh on current main:

• validate_spawn_worktree (lines 1712-1727) compares pwd -P strings of the resolved worktree, its Git top-level, and PROJ_ABS_REAL.
• real_path_or_raw (1695-1702), relaunch cwd check (2202-2213), and the treehouse settle loop (2237-2247) all compare those same physical path strings. Two consecutive settle reads must agree, but they agree on spelling, not on device/inode.
• Empty resolve fails closed, but two spellings of the same directory still compare unequal and can be accepted as isolated.
• No stat device/inode comparison exists. "device" in this file is only an OAuth device-code comment.

Related work inspected, not a duplicate:

• fix(bin): reconcile treehouse pool path spellings on a symlinked home #2692 is still open (fix(bin): reconcile treehouse pool path spellings on a symlinked home). That is teardown/treehouse inventory string match for /home vs /local/home symlinks, not spawn's primary-checkout identity check.
• fix(herdr): retire a created workspace a foreign pane keeps alive #2637 is still open and is Herdr created-workspace retirement, not spawn path identity.
• fix(bin): refuse spawn worktrees outside the project's own repository #2562 is still open and is repository-ownership refusal, which the report correctly calls complementary: same-repo identity can still name the primary checkout.

A remaining spawn identity bug is not closed as a duplicate of an unmerged PR. Marking ready-for-pr.