chore(git): ignore .claude/worktrees/ so agent worktrees never enter history

[Goosterhof]

Agents in the war-room harness create ephemeral worktrees at .claude/worktrees/agent-<id>/. This repo did not ignore that path, so the directory appears as untracked — and a git add -A stages an entire second checkout into history.

One line, placed to match this repo's existing .claude ignore convention. No source, build, or CI behaviour changes.

Context: a fleet sweep found 14 of 20 territories missing this rule; all 20 now carry it. Verified per-repo with git check-ignore -v .claude/worktrees/agent-probe, using a probe first proven against a repo that already had the rule and one that did not — the naive bare-path probe under-reports on anchored /.claude/worktrees/ patterns, which is how the gap went unmeasured.

War-room ref: WR-0740.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S2VXufzVp9JpkZiJJ9skbC

[Goosterhof]

🔴 Majors — 1
One-line .gitignore addition; verified the pattern actually ignores a path inside the directory (git check-ignore -v .claude/worktrees/agent-probe → matched at .gitignore:10) rather than trusting the bare-path probe the PR body itself warns is under-reporting. No tracked files under .claude/worktrees/ to worry about a stray unignore.

Required check check (8.4) / check (8.5) fail — codeload 429/503/502 on shivammathur/setup-php download at "Prepare all required actions", before checkout even runs. Unrelated to this diff (a .gitignore-only change can't touch a GitHub Actions action-cache fetch); matches reference_codeload_429_blocks_self_hosted_ci.md. Caps verdict below approve-worthy per the CI cap — re-run once codeload recovers.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.

[Goosterhof]

COMMENT — own PR, self-approve blocked by GitHub.

Re-review at eb29865ec (head moved since round 1). Two commits on this branch:

1. a732e09 — the .gitignore line itself, already verified (git check-ignore -v .claude/worktrees/agent-probe matches at .gitignore:10; no tracked files under the path to worry about a stray unignore).
2. eb29865 — composer.lock-only dependency bump (guzzle 7.14.2→7.15.3, promises 2.5.1→2.5.2, psr7 2.12.5→2.13.0, commonmark 2.8.3→2.10.0, nette/schema 1.3.5→1.3.6, nette/utils 4.1.4→4.1.5) clearing a base-inherited composer audit finding that was gating this PR's own CI. composer.json is untouched — lockfile-only, within existing constraint ranges (confirmed by check (8.4)/check (8.5) passing, which run composer install against the lock).

Prior round's Major (check (8.4)/(8.5) failing on codeload 429/503/502, unrelated to the diff) — resolved: both required checks and ci-passed are green on this head. Verdict clears above the CI cap that held it last round.

No new findings. Approve-worthy but for the self-review restriction — merge is clear once armed.

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.