fix(portfolio): keep worktree observations coherent

[saagpatel]

Summary

• derive configured local state from the already captured worktree observation
• remove the redundant second Git read that could create a TOCTOU-inconsistent snapshot
• add a regression simulating a worktree changing between the former duplicate reads

Causal evidence

The untouched com.d.portfolio-maintenance 02:00 run failed at 2026-08-05T09:07:10Z with Configured repository worktree for portfolio-index does not match local. The representative checkout was concurrently changing, while checkout authority correctly remained UNKNOWN. No digest was published.

Verification

• pytest -q: 3499 passed, 2 skipped
• ruff check .: pass
• mypy src/portfolio_repository_state.py: pass
• focused repository-state tests: 17 passed

Safety

This does not select a checkout, clean a dirty tree, or weaken UNKNOWN behavior. It makes local and worktrees come from the same read and preserves the observed dirty state.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.