Add managed worktree creation (#42196)

## What changed

- Add `WorktreeManager::create` to create detached, Desktop-compatible worktrees from `HEAD` or an explicit base while preserving the source working-directory path.
- Isolate worktree Git operations from inherited repository selectors, hooks, filesystem monitors, and configured content filters.
- Validate the destination working directory and roll back incomplete worktrees and empty allocation buckets on failure.

## Testing

- Cover layout, base selection, annotated tags, nested working directories, Git environment isolation, filter suppression, source checkout preservation, unsafe symlinks, and creation rollback.

GitOrigin-RevId: bf172c3ff4268dab603d00a1d547485fcd0de368

codex-rs/git-utils/src/operations.rs

@@ -10,6 +10,22 @@ use crate::GitToolingError;
 
 const DISABLED_HOOKS_PATH: &str = if cfg!(windows) { "NUL" } else { "/dev/null" };
 
+/// Encodes Git overrides without treating equals signs in keys as separators.
+pub fn git_config_override_env(
+    overrides: impl IntoIterator<Item = (String, String)>,
+) -> Vec<(String, String)> {
+    let overrides: Vec<_> = overrides.into_iter().collect();
+    if overrides.is_empty() {
+        return Vec::new();
+    }
+    let mut environment = vec![("GIT_CONFIG_COUNT".to_owned(), overrides.len().to_string())];
+    for (index, (key, value)) in overrides.into_iter().enumerate() {
+        environment.push((format!("GIT_CONFIG_KEY_{index}"), key));
+        environment.push((format!("GIT_CONFIG_VALUE_{index}"), value));
+    }
+    environment
+}
+
 pub(crate) fn ensure_git_repository(path: &Path) -> Result<(), GitToolingError> {
     match run_git_for_stdout(
         path,