feat(files): follow the agent into a worktree outside the session folder

#772 made the Files panel follow an agent into a worktree inside the
session's folder. A worktree beside the repository (git worktree add
../feature, or an EnterWorktree into one that already exists there)
stayed unfollowed, since serving it needs a second confinement root.

findOutsideWorktree() answers that case without running git. The
nearest .git above the pane must name <common dir>/worktrees/<id> of the
session's own repository, and that registry entry must name the
candidate back (or the .git folder must be the common dir itself). It
refuses /, the home folder and above, any folder holding workingDir and
Docker case workspaces, and multi-user mode applies the owner's
folderAllowedForUser rule. The answer is liveWorktree with outside: true
and the folder's real path.

The file routes serve an absolute path inside that worktree, and only
while the folder still resolves to the recorded path. A relative path
still resolves against workingDir alone. The browser routes such paths
to the editable preview, and root-relative markdown refs resolve from
the top of the worktree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/types/session.ts

@@ -939,13 +939,17 @@ export interface SessionState {
    */
   paneCwd?: string;
   /**
-   * The linked git worktree inside `workingDir` that the pane is in NOW, when there is one:
-   * Claude Code's `.claude/worktrees/<name>`, or any other worktree of the repository under
-   * the session's folder. Derived from {@link paneCwd} by `live-worktree.ts`, so it is
-   * runtime-only and absent wherever `paneCwd` is, and absent for a worktree outside
-   * `workingDir`: the file routes never serve those. NOT a confinement root; the Files panel
-   * only starts its listing here, after `GET .../files` has checked that the real folder still
-   * lies inside `workingDir`, since a symlink can replace it without moving the pane.
+   * The linked git worktree that the pane is in NOW, when there is one. Derived from
+   * {@link paneCwd} by `live-worktree.ts`, so it is runtime-only and absent wherever `paneCwd` is.
+   *
+   * Usually it lies inside `workingDir` (Claude Code's `.claude/worktrees/<name>`), and then it is
+   * NOT a confinement root: the Files panel only starts its listing here, after `GET .../files`
+   * has checked that the real folder still lies inside `workingDir`, since a symlink can replace
+   * it without moving the pane.
+   *
+   * With `outside: true` it is a worktree of the session's repository outside `workingDir`, which
+   * the repository itself vouched for, and its `path` is a real path. The file routes then serve
+   * absolute paths inside it as a second root, while it still resolves to that same path.
    */
   liveWorktree?: LiveWorktree;
   /** Remote execution metadata, present when this session runs over SSH through local tmux */