fix: keep managed worktrees inside the selected repository

[Meta-Develop]

Managed worktrees defaulted beside their repository, leaving generated lanes and Cargo configuration in the parent workspace. New implicit lanes use <repo>/.maco/worktrees/<sanitized-repo-name>/<agent-id>. Register only the exact managed group in authenticated primary Git info/exclude so raw candidate capture and Git index operations preserve a clean primary. Preserve operator contents, modes and negations, reject unadmitted config indirection, and fence repository/config/ignore generations. Explicit roots receive no automatic exclusion.

Discover exact new and legacy grouped sweep roots within the workspace and its direct repository children, preserving stored bindings and primary/common-directory authentication. GC and reconciliation recognize registered lanes by validated actual basenames. Anchor native Git ignore checks to the bound repository, and keep embedded-child status caches outside the primary. Primary/candidate integrity production predicates remain unchanged; manual .worktrees content receives no new exemption.

Validation at 2c45e411: independent full eleven-file logic/privacy review PASS; all GitHub checks PASS, including the required Rust CI gate, Linux formatting/all-target check/strict Clippy, every integration test, Windows/macOS all-target check and test compilation. Linux library partitions passed 3,102 rest, 973 supervise and 57 autopilot tests, with 16 existing ignored tests. The real renamed-manual destructive GC/reconciliation regression and new managed-creation/primary-integrity regressions passed. Eight focused portable tests, offline native library checking, full formatting and whitespace checks also passed.